Characterizing interactions among security features

Characterize how security features interact, determine how those interactions affect security properties, and develop ways to capture the interactions, including interactions that may weaken or violate security properties.

Background

Security properties often emerge from the interaction of multiple features. For example, authorization depends on authentication to establish the identity used for an authorization decision. Incorrect, incomplete, or unexpected interactions may weaken security even when individual features are correctly implemented, making their systematic characterization an unresolved problem.

References

Security Gap Analysis between A2A and MCP. While this paper treats A2A and MCP as complementary protocols operating at distinct layers, their combination in production deployments creates a composite attack surface that neither specification addresses in isolation. Future work should systematically characterize the security properties of A2A–MCP integration points: specifically, how trust established at the A2A layer propagates into MCP tool invocations, whether prompt injection at the MCP layer can influence A2A task delegation decisions, and what authorization invariants must hold across the boundary between the two protocols to prevent cross-layer privilege escalation.

— A2ABreak: Systematic Security Analysis of the A2A Protocol  (2609.10871 - Lotfi et al., 9 Sep 2026) in Section 8, Conclusion and Future Work

But how do security features interact, how do these interactions affect security properties, and how can they be captured?

— The Security Feature Location Problem  (2609.04899 - Hermann et al., 4 Sep 2026) in Section 5, Research Challenges, subsection “C1.3: How do security features interact?”