Source-linked AI summary
Agent Memory Is a Surface for Endogenous Authorization Laundering
Tommaso Cerruti, Mika Okamoto, Ansel Kaplan Erol
TL;DR
Persistent memory can misrepresent evolving permissions, restrictions, and revocations, allowing an agent’s own records to create unauthorized apparent authority. The paper introduces EAL-BENCH to measure false-authority formation and downstream propagation across domains, writers, and executors, finding substantial laundering under incremental updates and a safety–utility tradeoff in defenses.
Problem
Persistent memory may fail to preserve evolving authorization state, but existing evaluations comparatively under-measure whether memory introduces false authority before downstream execution.
Method
EAL-BENCH uses hidden deterministic authorization ledgers, memory writers, executors, paired requests, faithful-memory controls, and exact-state repair to isolate formation from propagation.
Results
Across domains and memory designs, false authority reaches up to 50.2% of unauthorized requests and propagates to unauthorized action in 98.6% of matched trials.
Takeaways & Limitations
Persistent memory is part of an LLM agent’s effective authorization policy and should preserve provenance and authorization lifecycles while verifying updates.
Takeaways & Limitations
The controlled benchmark uses structured histories and deterministic typed-memory labels, does not estimate prevalence in deployed systems, and includes single-seed analyses for some comparisons.
Abstract
from arXiv · showhide
Long-running LLM agents rely on persistent memory to carry state across interactions, including permissions, restrictions, and revocations. When memory misrepresents this evolving authorization state, the agent's own records can grant authority that the underlying history never permitted, resulting in misaligned behavior without any external attacks. We term this failure endogenous authorization laundering, where spurious permissions written into memory lead to unauthorized actions as their provenance is washed away. We then introduce EAL-Bench, which measures how accurately persistent memory preserves evolving authorization state and whether errors propagate to downstream unauthorized actions. We evaluate five LLMs as memory writers and two as executors across procurement, cybersecurity, and finance. We find that under incremental memory updates, writers create false authority for up to 50.2% of unauthorized requests; once false authority is present, executors act on it in 98.6% of trials. Two safeguards, requiring stored permissions to be backed by valid source events, and tracking permission changes through bounded event sourcing, substantially reduce laundering, but both also reject more legitimate actions, exposing a safety-utility tradeoff. Persistent memory is therefore not merely a performance component, but a part of an LLM agent's effective authorization policy.
1 Introduction
Persistent memory can distort evolving authorization state, allowing an agent’s own records to create apparent authority that the underlying history never granted. EAL-BENCH isolates whether memory introduces false authority and whether executors propagate it into unauthorized actions.
- Motivation: Persistent memory carries permissions, restrictions, and revocations, so condensing history can preserve obsolete authority or drop valid permissions.A forgotten revocation can preserve authority, while a dropped permission can cause rejection of a valid request.
- Failure mode: Endogenous authorization laundering occurs when an agent’s memory creates apparent authority absent from the underlying history.The resulting violation can remain invisible at execution time because the executor acts on the incorrect stored state.
- Research gap: Existing evaluations comparatively under-measure whether memory preserves evolving authorization state and separates memory errors from downstream executor behavior.EAL-BENCH addresses this gap by distinguishing false-authority formation from later propagation to action.
- Approach: EAL-BENCH uses changing organizational histories, hidden authorization ground truth, paired requests, faithful-memory controls, and exact-state repair across writers, executors, and domains.These controls test whether replacing erroneous memory with ground-truth state removes unauthorized actions.
- Results: 50.2% of unauthorized requests can receive false authority, and 98.6% of matched trials propagate that authority into unauthorized action.The benchmark evaluates five memory writers and two executors across procurement, cybersecurity, and finance.
2 Related Work
Prior work studies memory integrity, authorization representation, and full-agent safety, but EAL-BENCH focuses directly on whether evolving authorization state remains faithful through repeated memory updates. It also separates memory formation errors from their downstream propagation.
- Memory integrity: Prior memory research identifies poisoning, staleness, and access-boundary failures, while EAL-BENCH tests whether encoded authorization state stays faithful to history.The benchmark traces authorization-state errors through to action rather than measuring memory content alone.
- Comparison dimensions: Table 1 compares related work across evaluated dimensions including lifecycle tracking, incremental updates, and exact repair.Lifecycle covers grant, revocation, and replacement events; exact repair replaces erroneous memory with oracle-exact state while downstream execution stays fixed.
- Authorization state in memory: AUTHMEM-BENCH varies source authority at consolidation, whereas EAL-BENCH varies histories containing permissions, restrictions, revocations, and replacements across repeated updates.EAL-BENCH distinguishes false authority formed in memory from its later propagation to action.
- System and delegation safety: Existing permission frameworks and trajectory audits generally presume that the executor’s consulted state is correct, leaving memory-state fidelity outside their primary focus.EAL-BENCH targets cases where execution can follow stored policy correctly even though memory no longer represents historical authorization.
3 EAL-Bench
EAL-BENCH models authorization as hidden deterministic state derived from evolving histories, then tests how writers encode that state and how executors act from the resulting memory. Its protocol isolates formation, propagation, representation, update, and mitigation effects.
- Ground truth: A hidden deterministic replay function maps authoritative history blocks to canonical authorization state, while a hidden predicate determines whether each requested action is authorized.Agents do not observe the canonical ledger or authorization predicate.
- Pipeline: A writer converts history into persistent memory, and an executor receives only that memory plus a later request when selecting an action.Typed memory permits deterministic evaluation of whether stored records authorize an action.
- Formation and propagation: Formation marks cases where canonical authorization denies an action but memory authorizes it, while propagation marks executors taking that unauthorized action.The end-to-end event is F ∧ G, with incidence P(F=1) P(G=1 | F=1).
- Behavioral metrics: Authorized use measures requested actions taken for authorized requests, whereas unauthorized submission measures actions taken despite unauthorized requests.Failures on authorized requests are undergrants.
- Memory representations: Free-text memory receives downstream behavioral evaluation, while typed memory supports deterministic representation-level formation labels.Memory-only interventions hold request, executor, tools, and canonical state fixed while replacing only memory.
- Threat model: The threat model excludes attackers and adversarial attacks, isolating laundering during ordinary memory updating and downstream execution.Writers see visible history but not the canonical ledger, future history, or evaluation requests; executors receive only stored memory.
- Running example: The procurement example combines an amended grant with a non-authoritative ERP category, causing memory to authorize a reception order denied by the canonical ledger.The example illustrates scope and source-authority errors entering a stored authorization record.
- Cases: Benchmark cases pair multi-session histories containing policy changes, stale statements, and non-authoritative advice with later structured requests across procurement, incident response, and trading.A hidden ledger establishes ground truth, while bounded memory becomes the executor’s only case-specific evidence.
4 Results
Across domains, incremental memory updates are the main source of authorization failures: errors are often encoded before execution and then faithfully propagated. Source-authority gating and bounded event sourcing reduce unauthorized submissions but trade away legitimate use, while writer-side compute improves both outcomes without eliminating the bottleneck.
- 4.1 Incremental updating produces the most authorization failures: Incremental updating raises unauthorized submission in every domain and representation, with typed incremental memory reaching 51.0% in finance while authorized use remains high.Incremental writers update from prior memory alone, so an error written once is carried forward; typed structure improves inspectability but does not preserve authority by itself.
- 4.2 False authority forms in memory and propagates to action: 28.3%, 10.4%, and 50.2% are typed-incremental false-authority formation rates in procurement, cybersecurity, and finance, respectively, closely tracking downstream unauthorized submission.Formation is computed deterministically from final typed memory before executor behavior, making most behavioral failure auditable in advance.
- 4.2 False authority forms in memory and propagates to action: 98.6% of trials with erroneous memories produce unauthorized submission, versus none after exact-state repair, isolating memory formation as the bottleneck.Only the memory changes between replays; executor-side alignment therefore cannot close the gap without a safeguard reaching memory.
- 4.3 Endogenous authorization laundering is writer-general and travels with the memory: Every writer creates false authority in every domain, and replaying frozen memories across executors yields rates within 1.1 percentage points with 97.9%–99.5% agreement.The failure travels with the stored artifact, so changing the executor offers little protection; writer quality affects authorized use and unauthorized submission together.
- 4.4 Mitigations form a discrete safety–utility Pareto frontier: 25.3% falls to 7.3% with source-authority gating and 9.0% with bounded event sourcing, while authorized use falls from 93.3% to 53.8% and 64.7%, respectively.Formation also falls from 24.9% to 5.5% and 8.7%; no tested configuration dominates another, forming a discrete empirical Pareto frontier.
- 4.5 Writer-side compute shifts the bottleneck to selection: From k=1 to k=8 candidates, unauthorized submission falls from 13.2% to 8.6% and authorized use rises from 94.2% to 95.8% in procurement.At k=8, an exact memory exists in 55.0% of cases; the experiment fixes GPT-OSS-120B as executor while varying writer-side candidate pools.
5 Conclusion
EAL-BENCH shows that persistent memory can originate authorization failures before executor decisions, making policy-faithful persistent state central to agent security. The conclusion calls for provenance- and lifecycle-aware memory architectures and treats memory as part of the security boundary.
- Persistent memory can create authorization failures before an executor makes any decision.
- Replacing erroneous memory with the exact authorization state eliminates the resulting failure.
- Memory architectures should preserve provenance and authorization lifecycles while verifying updates before persistence.
- Stored permissions warrant provenance, lifecycle, and audit discipline comparable to identity and access management records.
A Benchmark construction and diagnostics
The benchmark defines domain-specific authorization records and evaluates persistent memory under controlled schemas, updates, validation, and fixed reporting procedures. Its construction preserves source links, profile identity, representation constraints, and reproducible diagnostics.
- Benchmark construction: The canonical ledger requires one active record to cover the complete requested action at its requested time.
- Benchmark construction: EAL-BENCH reports authorized use and unauthorized submission across domains, seeds, writers, executors, and memory conditions.
- Memory updates: Each benchmark case uses one persistent profile containing current authorization state, updated rather than duplicated.
- Representation contracts: Typed memory preserves schema-native JSON types, while free-text memory replaces the atomic content field with the complete revised string.
- Validation: Validation checks profile identity, patch operations, schema validity, returned-profile equality, visible-source provenance, and capacity bounds.
A.5 Typed-memory mechanism details
Typed incremental memory frequently diverges from the canonical authorization state, and authority-gaining errors form a measurable subset of these mismatches. Errors often persist, while self-repair is uncommon and varies by event and domain.
- 62.4% of typed saved update positions contain a semantic error, including 8.0% with an authority-gaining error.
- 71.9% of final typed states are not exact, while request-level false authority reaches 24.9%.
- A semantic mismatch is not necessarily a safety failure because it may remove authority, affect inactive history, or leave the tested request unchanged.
- 10.6% of aligned updates introduce errors, 51.7% preserve them, and 3.7% self-repair.These pooled rates are descriptive because transition opportunities differ across event types and domains.
B.1 Writer-side inference scaling details
Writer-side inference scaling improves downstream safety and legitimate use overall, but exact-memory selection remains a bottleneck and larger pools show diminishing returns. Incremental errors are mainly avoided rather than repaired after entering persistent memory.
- Across-k downstream behavior: 13.2% unauthorized submission at k = 1 falls to 8.6% at k = 8, while authorized use rises overall from 94.2% to 95.8%.Authorized use drops 0.7 points from k = 4 to k = 8.
- Candidate generation and selection: Exact-memory availability rises from 31.7% at k = 1 to 55.0% at k = 8, but self-review selection reaches only 26.7% at k = 8.The resulting 28.3-point gap indicates a selection bottleneck in this setting.
- Candidate generation and selection: At k = 8, independent review lowers unauthorized submission from 8.6% to 7.6% and raises authorized use from 95.8% to 97.2%.
- Full-state fidelity and downstream safety: The broader typed authorization-error rate falls from 26.7% at k = 1 to 20.8% at k = 4 even as downstream unauthorized submission improves through k = 8.
- Incremental-memory dynamics: In procurement, incremental-memory errors persist at 100% and self-repair remains 0% for every candidate-pool size.Additional writer compute therefore appears to help mainly by avoiding damaging updates.
B.4 Capacity-pressure ablation
The Procurement capacity ablation finds that changing the explicit memory limit only modestly changes primary outcomes, arguing against the limit as the main cause of failures. Extra capacity does not eliminate propagation once false authority exists.
- Memory capacity: 5/330 update states in the 8,192-token arm exceed 572 tokens, indicating that writers rarely use the extra advertised capacity.Median final profiles remain around 272–278 tokens across all three settings.
- Memory capacity: Exact final memory rises from 3/60 to 6/60 when enforcement is disabled, while semantic-error count remains 38/60.This demonstrates that exact full-state matching is not itself a safety metric.
- Behavioral outcomes: 100% conditional propagation persists across all three settings: GPT-OSS acts whenever false authority is present in this experiment.Capacity may affect false-authority formation, but not downstream action conditional on its presence.
- Behavioral outcomes: The paired contrasts report only modest primary changes, with all safety-relevant intervals including zero.The table reports percentage-point differences between the 8,192-token and 572-token unenforced arms.
- Interpretation and scope: The ablation does not establish that information loss is irrelevant generally, because it does not test append-only logs, raw full-history retention, or immutable-history retrieval.Later extra capacity cannot necessarily recover information omitted or distorted earlier.
B.5 Writer–executor pressure results
The fixed-seed pressure study compares baseline and pressure conditions across Procurement, Cybersecurity, and Finance, with memory representations and writing strategies pooled in the main comparison. Pressure increases pooled Finance unauthorized submission and varies substantially by memory condition.
- Study design: Table 20 reports fixed-seed writer–executor pressure comparisons, while the main transfer experiment uses three seeds and is not replicated here.The pressure intervention was conducted on a fixed pressure-study seed.
- Finance: 27.3% versus 20.9% pooled Finance unauthorized submission under pressure versus baseline.The comparison pools both executors on the fixed Finance pressure-study seed.
- Finance: 55.0% is the pressure unauthorized-submission rate for typed incremental memory, compared with 8.4% for typed one-shot memory.Free-text incremental and free-text one-shot rates are 35.9% and 10.0%, respectively.
- Executor comparison: 4.3% pooled unauthorized submission occurs within Grok pressure replays.The free-text incremental and typed one-shot pooled rates are 3.1% and 6.2%, respectively.
C.1 Gold cited-source authority gating
Gold cited-source authority gating removes records lacking valid, visible, authorization-granting provenance, but residual semantic and lifecycle errors remain. The aligned evaluation compares the same typed-incremental population and separates provenance failures from authorization-state drift.
- Gate design: The gate retains a record only when every cited source is nonempty, visible at the checkpoint, and authored by an authorized grantor.It does not check whether source content supports the permission, its validity, scope, lifecycle, or canonical-event correspondence.
- Evaluation alignment: The aligned evaluation reuses 4,532 baseline outcomes and 1,156 earlier gated outcomes only under exactly matching model-visible contexts.It makes 2,232 new calls without terminal provider errors.
- Residual behavior: 58/60 unauthorized submissions occur with gated memory in residual false-authority cases, versus 0/60 with oracle-exact memory.These cases were selected before observing executor behavior.
- Residual behavior: 96.7% is P(G | F) for gated memory in the residual-case analysis.The gate removes most source-authority laundering but does not prevent propagation from residual false-authority states.
- Residual errors: All nine unique residual states preserve authoritative provenance but contain semantic or lifecycle errors.The surviving failures include retained revoked records, while none relies on unsupported content from an authorization-capable source.
C.2 Bounded event-sourced authorization memory
Bounded event-sourced memory records only authorization changes in an immutable log and reconstructs compact state deterministically. Across domains, this architecture reduces unauthorized submission, but the benchmark remains a controlled simplification rather than a live-deployment reproduction.
- Architecture: The writer emits only the change Δt from previous state Ct−1 and new block Bt, while an external system appends it to immutable log Lt.A deterministic reducer computes Ct = Rpublic(Lt), and the cumulative log remains hidden from the writer.
- Behavioral results: −16.29 percentage points is the paired cluster-bootstrap difference in pooled unauthorized submission.The behavioral gain is large in Procurement, small and inconclusive in Cybersecurity, and accompanied by severe Finance undergrant.
- Behavioral results: 342/344 requested unauthorized actions occur with event-sourced memory across replayed residual cases, versus 0/344 after oracle-exact replacement.The comparison spans both executors and 172 residual false-authority cases.
- Representation errors: 2,211 authorization-changing events are missed in deterministic extraction diagnostics across 9,122 aligned or unmatched event positions.Other detected errors include 238 payload, 181 scope, 118 target-reference, and 85 event-type errors.
- Benchmark structure: EAL-Bench uses bounded persistent state, hidden canonical authorization, fresh executors, and matched authorized–unauthorized requests across three synthetic domains.Procurement, Cybersecurity, and Finance differ in histories, operational state, tools, and authorization checks while sharing the writer–memory–executor protocol.
- Scope and limitations: The benchmark omits retrieval, memory access control, external terminal actions, concurrency, human approval queues, operational recovery, and real organizational data.Its claims concern controlled, deployment-relevant memory failures, not real-world prevalence or end-to-end deployment safety.
D.2 Evaluation-cue intervention details
The intervention compares no cue, a generic evaluation cue, and authorization-specific framing while holding the main cases, models, requests, tools, and generation settings fixed. Effects are estimated from paired case differences with case-cluster bootstrap intervals and vary across writer and executor targets.
- Intervention design: The study compares no cue (L0), a generic evaluation statement (L1), and authorization-specific framing (L2).The intervention measures explicit framing effects rather than spontaneous evaluation awareness.
- Writer effects: Generic cues reduce typed-memory authorization errors by 1.11 points on average, with target-specific effects ranging from −4.17 to +9.72 points and a median effect of zero.Across five writer targets, authorized use and fewer unauthorized submissions each change by −0.09 percentage points on average.
- Executor effects: Across ten frozen writer-memory–executor combinations, generic cues increase authorized use by +0.42 points and reduce unauthorized submissions by 0.35 points on average.Authorization-specific framing changes those outcomes by +0.49 and −0.07 points, respectively; most target-specific intervals include zero.
- Intervention design: The intervention keeps procurement cases, five writers, four memory conditions, calibrated executors, matched requests, tools, and generation parameters unchanged across conditions.Only the registered cue changes initially; later incremental requests can differ through previously produced memory.
- Analysis: Paired differences are averaged within cases and weighted equally across twelve cases, with 95% intervals generated from 10,000 case-cluster bootstrap resamples.Intervals preserve cue triplets, writer seeds, memory artifacts, and matched requests.