An agent gateway blocks a sequence: identity mutation followed by credential recovery.
The rule is simple. If a session changes the contact email on an account, the same session cannot request credential recovery. The predicate is correct. Tests cover it. Receipts show the prior action list, the mutation event, the recovery attempt, and the block decision. During review the guard looks solid, because the dangerous pair appears in one place and the system says no.
Now split the same two calls across two sessions. Session one changes the contact email on the customer record and ends. Session two starts fresh and asks for credential recovery. The prior actions list comes back empty. Same principal. Same customer record. Same attack. The guard allows it.
Nothing in the predicate failed. The memory it consulted was indexed by session_id, while the attack was indexed by the customer record.
Every runtime guard is backed by state, and that state has a primary key. Most guard failures are key bugs. The check's logic is right, yet the memory it consults is indexed by the wrong thing: a session, a resolve instant, a whole fleet. The attack composes over some other coordinate. The adversary wins without ever touching the predicate, by picking coordinates the index cannot see. The key under a guard's state table is a security decision, and almost nobody writes it down.
