An agent can make a perfectly consistent authorization decision and still be wrong if its memory has already rewritten who is allowed to do what.

This paper studies that failure in long-running agents, where permissions, revocations, and scope changes get compressed into persistent memory.

A revoked or narrowed permission can be remembered incorrectly, and that bad memory becomes the executor’s version of the truth.

In the paper’s typed incremental-memory tests, false authority appeared for up to 50.2% of unauthorized requests. Once that false permission existed, executors acted on it in 98.6% of matched trials.

Changing only the memory to the exact authorization state dropped those unauthorized actions to 0%. That points to memory, not the executor, as the main failure point in these cases.

The fix is to verify permissions before writing them into memory, preserve where each permission came from, and track grants, changes, and revocations with deterministic state updates.

– arxiv. org/abs/2609.01836

Title: "Agent Memory Is a Surface for Endogenous Authorization Laundering"