How do agent security layers connect across the stack?

The conclusion says it in one sentence: securing autonomous agents "is not a collection of isolated challenges but a systems problem spanning the entire agentic stack, from reasoning, memory, and tool use to multi-agent collaboration, model routing, behavioral containment, and ecosystem governance." The abstract supplies the map behind it, level by level:

| Level | Challenge the excerpt names | |---|---| | Single agent | untrusted inputs through prompts, memory, retrieved knowledge and tool interfaces | | Multi-agent | delegation and communication raise identity, trust, capability control and decision transparency | | Routing and control plane | manipulation, and unverified model provenance | | Behavior over time | behavioral containment | | Ecosystem | governance, named in the conclusion only |

The vault holds each level separately. How do adversarial traps target different layers of AI agents? is organized by an agent's own functions, from perception to oversight. Why do agents fail at identity verification and authorization? takes the multi-agent level. The routing level is new here (Can attackers manipulate which model handles a request?), and containment is the survey's thesis (Can step-by-step approval miss harmful behavior patterns?). This map is organized by scope, from one agent to many to infrastructure to behavior over time, where the Traps taxonomy is organized by function. The two cut the same territory along different axes, and the excerpt's map does not name a human-oversight level, which the Traps taxonomy does. A third cut comes from a multi-agent survey: Can adversary position unify fragmented multi-agent attack models? places an attack by who the adversary is, which interface it uses and what it does to the system, an axis neither this map nor the Traps taxonomy has. The same survey's thesis, Can individually safe agents fail when working together?, is a parallel survey-level claim that failure lives in composition, but it is restricted to multi-agent systems, where this map runs from one agent to ecosystem governance.

What makes it "not isolated" is the paper's own common theme: composition over time and across components. My reading is that the layers connect through trust. An untrusted input at the first level becomes a delegated instruction at the second, is routed at the third, and shows up as an action sequence at the fourth, so a defense at one level can be bypassed at another. That is a reading; the excerpt asserts interconnection without tracing a path. Is your evaluation environment actually part of the threat model? makes the same component-to-system move independently at a smaller scope, over a model with memory, tools, credentials, an execution environment and the response workflow, and its excerpt traces no path either.

What the excerpt does not give. Per-layer detail, any attack or defense, the content of "ecosystem governance", and Figure 1, which the introduction cites for the agent's components and flows. The stack is stated, not demonstrated.