Security Guards Can Fail Not From Logic Errors But From Wrong State Index Keys

A subtle but critical security vulnerability can exist in agent gateway systems even when guard logic is entirely correct. The flaw occurs when protective checks consult state indexed by session ID rather than by the actual customer record or authorization object being protected. This mismatch allows an attacker to split a malicious two-step sequence — such as changing a contact email then requesting credential recovery — across two separate sessions, making each session's history appear clean. Because the guard queries an empty session log, it finds no violation and permits the attack, despite the dangerous action sequence having occurred. The core lesson is that the primary key used to store and retrieve a guard's state is itself a security-critical decision that must align with the invariant being enforced.