An agent would do something valid early on, then later reuse that context and act slightly beyond intent. Nothing malicious, just accumulated authority.

What fixed it was step-level gating: each step gets explicit inputs and tools, then everything is torn down before the next step. Once assumptions couldn’t carry forward, whole classes of bugs disappeared.

I ran into this while using GTWY for a constrained agent workflow, and making permissions appear and disappear per step made the system far more predictable.

Curious if others have seen workflow design matter more than the runtime or model.

You want to wrap this kind of stuff in a search interface

This paper reads like slop, def not the level of abstraction, to borrow an oft repeated phrase for the paper, I'd expect from serious academic writing