Persistent State Can Outlive Its Authority

Modern agent-security work is advancing rapidly around memory poisoning, agent identity, delegated authorization, tool access, runtime security, and persistent context. Those areas address critical parts of the agent lifecycle. They also expose a further question:

An agent can remain identity-valid, policy-compliant, and tool-authorized while operating from inherited state whose authority has expired, been superseded, conflicted, or become contextually invalid.

The failure sequence

A reproduction case

Assume an agent receives a legitimate instruction that Production-East should use Endpoint A. The state is retained. Later, the same or higher authority supersedes that instruction and establishes Endpoint B.

The system resumes through its normal persistence mechanism and receives a legitimate request:

Deploy the current Production-East build to the approved destination.

The actor is legitimate. The task is legitimate. Tool access may be legitimate. The security question is which inherited state governs the decision.

A secure architecture should resolve the authority relationship, prevent the superseded state from governing execution, and select Endpoint B. If authority cannot be resolved confidently, execution should stop until authority is established.

Why this is not simply prompt injection

No malicious information is required. State A was legitimate. State B is legitimate. The failure emerges from how legitimate state is treated over time.

Checkpoint integrity is not authority

A historical checkpoint can be perfectly intact. Its contents can be authentic. Its integrity can be valid. Its authority can still be obsolete.

Cross-agent handoff

State transfer raises the same question. Information inheritance and authority inheritance are different properties.

The falsifiable question

Does an existing production agent architecture enforce the complete authority chain of inherited persistent state before that state can govern future execution?

A complete implementation would need to demonstrate, as one enforced operating boundary:

1. provenance validation;
2. trusted admission;
3. deterministic authority hierarchy;
4. controlled supersession;
5. conflict isolation;
6. immutable-constraint protection;
7. separation of retained state from present execution authorization;
8. mandatory pre-activation validation;
9. fail-closed behavior when authority cannot be established;
10. recovery to a known valid state.