The study, conducted by Creso Sá, Aytaj Pashayeva, Christine Weidenslaufer, and Emily Gong of the University of Toronto, is based on document analysis and semi-structured interviews with 17 administrators across three Canadian research-intensive universities. The researchers set out to answer a deceptively simple question: what actually happens inside universities when national research security mandates arrive on their doorstep? The answer, they argue, is an organizational form they call the embedded advisory model, and its details reveal a great deal about how universities absorb external demands that clash with their core values.

The context matters. Over the past several years, intensifying geopolitical competition, particularly between Western nations and China, has pushed research security to the top of the policy agenda in many countries. Canada has been no exception. The federal government introduced the National Security Guidelines for Research Partnerships in 2023, followed by the Policy on Sensitive Technology Research and Affiliations of Concern, which restricts federal funding for research involving named sensitive technologies when researchers have ties to listed foreign entities. Provincial funders such as Ontario have issued their own research security guidelines, and agencies including the Canada Foundation for Innovation and the National Research Council have published guidance of their own. Universities suddenly found themselves responsible for implementing a dense and evolving web of requirements.

What the University of Toronto team found is that rather than creating new enforcement units, universities located research security within existing administrative infrastructures. Research security professionals were positioned as advisors who help researchers interpret federal and provincial requirements, coordinators who connect scattered offices across the institution, and translators who render dense government policy into workable practice. This design choice is not accidental. Universities are famously loosely coupled organizations, in which central directives often struggle to reach the laboratory bench, and the researchers argue that the embedded advisory model reflects a pragmatic reading of that reality.

The most striking finding concerns legitimacy. Research security introduces considerations that sit uneasily with established norms of academic science, including openness, international collaboration, and researcher autonomy. Security professionals cannot simply order scientists to comply; they must sustain cooperation through trust-building, researcher-oriented communication, and pragmatic support for funding success. In practice, this means framing security requirements not as bureaucratic impositions but as tools that help researchers remain eligible for grants, protect their intellectual property, and keep valuable partnerships alive. The advisors’ authority rests on usefulness rather than coercion.

This dynamic echoes a broader pattern documented in organizational scholarship. Studies of professional support staff in universities have long shown that new administrative functions gain standing with academics only when they demonstrate value to the research enterprise itself. The research security professionals in this study appear to have internalized that lesson. Their work involves what the authors describe as legitimacy-seeking: continuously demonstrating that security review is compatible with, and even supportive of, the scientific mission. Where earlier waves of university professionalization, such as research administration and quality assurance, followed similar trajectories, research security may be the newest member of that family.

The embedded advisory model also has a distinctive technical logic. By embedding security expertise within existing structures such as research services offices, universities avoid the reputational costs of a visible policing function while still ensuring that risk assessments, disclosure reviews, and partnership screenings occur before proposals are submitted. The professionals interviewed for the study described working across the entire lifecycle of a research project, from helping a researcher decide whether a collaboration triggers federal screening requirements to advising on how to document risk mitigation measures for a funding agency. This positions them as what organizational theorists call relational regulators, governing the gap between formal rules and everyday scientific practice through ongoing relationships rather than one-off inspections.

Yet the study is careful to identify the structural limits of this arrangement. The authors point to gaps in policy coverage, meaning that some research activities and funding streams fall outside the reach of current security requirements. They also highlight uneven federal-provincial coordination, since universities must reconcile requirements from multiple levels of government that do not always align. And they flag the risk of inconsistent application, both within and across institutions, when implementation depends heavily on the judgment and relationships of individual advisors rather than standardized procedures. An advisory model built on trust, in other words, may struggle to deliver uniformity.

These findings matter well beyond Canada. Comparable debates are unfolding across the OECD: the European Union has grappled with balancing openness against protectionism, Australia has been urged to make its research security ecosystem work smarter, and American universities have published catalogs of actions taken to address security concerns while scholars document the collateral damage of US-China tensions on scientific collaboration. The Canadian case offers a concrete organizational template, and a cautionary tale, for institutions everywhere that are being asked to securitize research without destroying the openness that makes science productive in the first place.

The study’s broader contribution is to shift the analytical lens from national policy design to administrative practice. Much of the emerging literature on research security focuses on what governments mandate; this paper specifies what universities actually build. In doing so, it speaks to longstanding concerns in higher education scholarship about how universities absorb external mandates and under what conditions new administrative functions gain standing with scientists. The embedded advisory model may be an imperfect compromise between security and academic freedom, but it is the compromise that research-intensive universities have chosen, and understanding it is essential for anyone hoping to predict how the global research system will evolve under continuing geopolitical pressure.

Subject of Research: Implementation of research security mandates through an embedded advisory model at Canadian research-intensive universities

Article Title: Organizing research security: the embedded advisory model in Canadian universities

Article References: Organizing research security: the embedded advisory model in Canadian universities. (n.d.). https://doi.org/10.1007/s10734-026-01770-7

Image Credits: AI Generated

DOI: 10.1007/s10734-026-01770-7

Keywords: research security, Canadian universities, higher education, research governance, science policy, academic administration, geopolitical competition, policy implementation, research partnerships, national security, university organization, advisory model