Governed Agents Need Dynamic Permissions and Valid Evidence

Three verified developments point to a shared systems boundary for production agents. Agno has redesigned entity memory so stored facts can be corrected, retrieved by current relevance, and managed through a smaller agent-facing tool surface. A new permission-architecture paper argues that agents should receive only the capabilities required by the current task. A separate benchmark audit shows why reported agent scores cannot be trusted when an evaluation protocol exposes shortcuts that make the intended capability unnecessary.

These sources do not prove that any particular agent system is safe. Agno's evidence is project-authored; the permission work evaluates a synthetic dataset rather than a deployed enforcement system; and the benchmark audit depends partly on an LLM judge and heterogeneous trace sets. Their combined value is narrower: agent governance must control state, capability, and evidence as separate layers.

Persistent memory is becoming correctable operational state

Agno v2.8.4 (opens in a new tab), supported by merged PR #9177 (opens in a new tab), substantially redesigns entity memory around agent-directed capture and a four-tool surface: remember_about, link_entities, search_entities, and forget. Name and alias resolution support entity upserts; new facts can supersede stale facts without deleting history; recall injects entities relevant to the current message plus an entity directory; and persistent stores gain broader search.

The release is a meaningful competitor signal because memory is being treated as maintained state rather than an append-only transcript. It also exposes unresolved boundaries. Agno describes 8 REST turns, 4 MCP turns, repository tests, and adversarial review, but not an independent production evaluation. The change is intentionally breaking for EntityMemoryStore and default FileSystem tools. The PR also documents an unresolved MCP identity issue: a host-supplied user_id can override a pinned agent identity, while entities remain global.

For governed agent systems, correction and recall are not enough by themselves. A durable evidence layer must distinguish the current operational view from historical events, bind mutations to principals, and preserve why a fact was superseded. Runtime visibility should not be mistaken for an immutable audit trail.

Least privilege must narrow with the task

Dynamic Capability Scoping for Enterprise AI Agents (opens in a new tab) proposes a three-source permission architecture: a deterministic role ceiling, an independent task-context classifier, and deterministic prohibitions on dangerous permission combinations. A permission is granted only when it fits the role ceiling, is predicted as necessary for the task, and is not prohibited by policy. The paper also proposes an observe-only mode that logs actions the full policy would have denied before enforcement is enabled.

The authors release 600 synthetic enterprise prompts labeled across 15 deployable permissions. A single expert independently reviewed a 60-record sample covering 688 permission decisions. The paper reports Cohen's kappa of 0.917 before disagreement review and 0.967 afterward, while iterative policy refinement reduced ceiling violations from 46 to 3.

The strongest architectural signal is prevention through capability absence: a credential that is never placed in the agent's current context cannot be misused through that path. The evidence does not establish production enforcement performance. The dataset represents a fictional company, validation used one human reviewer who also adjudicated disagreements, the task classifier is assumed trusted, gradual scope change is excluded, and the full architecture remains an evaluation proposal.

Benchmark scores need protocol evidence

Do Agent Benchmarks Measure Capability? (opens in a new tab) defines protocol validity as the requirement that the intended capability remain necessary for earning a benchmark score. Its HackDetect audit traces an evidence chain from exposure, to agent exploitation, to a misleading score, while the proposed Mislead gap measures the difference between exploit-enabled and intended performance.

The authors audit 2,385 traces across 15 agent benchmarks. They report supported protocol findings in 67.0% of 494 Frontier Science traces and 66.7% of 36 AutoLab tasks; every other audited cohort is at or below 21.7%, and five cohorts contain no positive trace. Paired comparisons report score inflation between 0.45 and 1.00. Five cohorts were preselected as suspicious, so their rates cannot be interpreted as benchmark-wide prevalence.

This matters beyond benchmark design. Model and agent selection should retain the task specification, tool-scoped traces, visible and withheld resources, artifact validation, evaluation pipeline, and evidence that the reported score depended on the claimed capability. A high score without protocol evidence is not reliable support for a deployment decision.

Keelbase Signal assessment

Together, the three records support a layered governance model:

• Runtime state should be correctable and queryable while historical evidence remains separately durable.
• Agent capabilities should be narrowed by principal, task context, and deterministic policy before execution.
• Evaluation artifacts should preserve enough trace and protocol evidence to show what capability a score actually measured.
• Application-layer memory and permission controls are useful implementation patterns, but they do not replace structural authorization, principal binding, or immutable accountability.

Two peripheral signals were reviewed but not promoted into independent records. Agno's TrustedRouter addition lacks enough published architectural detail to support a separate conclusion. Persistent Computational State (opens in a new tab) offers strong session-runtime results for generative world models, but its direct evidence concerns world-model serving rather than governed organizational agents.