Compositional Risk
Compositional risk is the security exposure that emerges from an agent's accumulated access path, evaluated in aggregate rather than as individual requests in isolation. Granting email access is routine when the agent only holds read-only document access. The same email access becomes an exfiltration channel when the agent already holds PII database access.
Why It Matters
Traditional access control evaluates each permission grant independently. This works for humans because human actions are slow, sequential, and observable.
Agents break this because they chain together multiple accesses in a single session, often within seconds. The risk is not in any single tool call but in the combination. Read access to a customer database plus write access to email plus access to an external API creates a data exfiltration path that no individual grant would flag.
Compositional risk evaluation requires the governance layer to maintain session state and evaluate each new tool call in the context of what the agent has already accessed.