Memory, Authority, and Money

What turns a useful tool into a risk

A tool-using agent that forgets everything and holds no credentials is a fairly contained thing.

Three additions change that completely: persistence, delegated authority, and economic capability.

Persistence: the agent that remembers

Suppose the agent keeps notes — a database of past interactions, a vector store of documents it has read, a running summary of what it knows about you.

Enormously useful. Also a new category of risk, for three separate reasons.

It is a data store. Everything the agent has ever seen may now sit somewhere, possibly for a long time, in a service you never evaluated.

It is a target. An attacker who cannot compromise a single run may poison the memory, so the agent misbehaves on some future run. The attack and the damage are separated in time, which makes them hard to correlate.

It crosses boundaries. Memory shared across users, sessions, or tenants is a leak waiting to happen. If your agent remembers something from user A and mentions it to user B, no cryptography in this course will help you.

Persistence turns a single compromised interaction into a durable one.

Delegated authority: handing over the keys

An agent can read the web with nothing but a network connection. To book a flight, it needs your authority — your account, your credentials, your card.

The instant you provide that, the security question inverts.

Before: what can the agent see?

After: what can the agent do, in your name, that you would be held responsible for?

This is the point where an agent stops being a tool you use and becomes an actor that represents you. Legally, financially, and reputationally, its actions attach to you.

Most teams grant this casually — an API key in an environment variable, an OAuth token with broad scopes, a wallet with a full balance. Stage 3 is about doing it properly.

Economic capability

A special case of delegated authority, but it deserves separation because it changes who attacks you.

An agent that can move money is a target for people who do not care about you at all. Everything else attracts attackers who want your data or access. Economic capability attracts attackers who simply want money — and there are vastly more of those.

It also removes the friction that normally slows an attack down. No stolen data to sell, no buyer to find, no laundering step. The theft is the payoff.

Economic capability also tends to arrive quietly. A team adds a payments tool to an existing agent, and the risk profile of the whole system changes without anyone re-running the security review.

The four rungs

Each rung includes the capabilities of the one below.

Single-turn model inference. Stateless. Text in, text out. No memory, no tools, no side effects.

Tool-using agent. A reasoning loop within a bounded session. Calls external APIs based on its own output. Session ends, state ends.

Autonomous multi-step agent. Operates over extended time horizons. Maintains explicit goals, decomposes them, chooses strategies, handles failures. May hold its own credentials.

Multi-agent system. A network of autonomous agents that communicate, negotiate, delegate, and transfer value — potentially with no human in any individual interaction.

Key takeaways

• Persistence separates attack from damage in time and creates a cross-tenant leakage surface.
• Delegated authority inverts the question from what the agent can see to what it can do in your name.
• Economic capability changes who attacks you and removes the friction that normally slows attacks.
• Four rungs: single-turn, tool-using, autonomous multi-step, multi-agent.