AI Agent Action Gates Need Current-State Evidence

A tool request does not always contain everything a gate needs to decide. The same request can be legitimate for one resource state and harmful for another. For an agent builder, that means a target-side allow or deny decision may need bounded current-state evidence, not just the request and a clean-looking history.

The signal

In SEAD: A State-Based Perspective on Attack and Defense in Tool-Using Agents, Zhibin Wang and colleagues model a tool-using agent as acting against a partially observed environment. Their defender can make limited, private, read-only queries before it permits or blocks a pending action. After a block, each later proposed action goes through the decision again.

On the authors' stated 75-task online subset using GPT-5.6 Luna, their SAGE defender reduced DART hard executable attack success from 48.0% without defense to 4.0%. That result belongs to the paper's selected models, synthetic tool environments, harmful objectives, read-only interface, and scoring rules. It does not show that any WTK target has the same exposure or would obtain the same result.

The useful contradiction is smaller. An action description and its visible history can be compatible with resource states that require opposite decisions. In that situation, a gate that sees only those inputs cannot reliably identify the boundary it is meant to enforce.

What WTK should separate

WTK packages remain the durable source of authority. Current mutable resource state should not be copied into a package or allowed to grant permission. But a target may still need a narrowly declared, read-only observation to determine whether an already-authorized action would cross a prohibited boundary in its present environment.

Consider an agent asked to update a customer record. The package can define which update action is allowed and when approval is required. It cannot safely assume that the record remains ordinary if the target's current classification has changed. A target receipt therefore needs to distinguish the declared authority from the state evidence used to apply it.

This is different from testing whether a target survives a long state history, as A Safe Target Has to Survive Its Own History considers. It is also different from asking whether a retrospective monitor discovers completed harm. Testing AI Agent Monitoring and Harm Prevention separates those roles. SEAD points to the evidence available at one pre-execution decision and to the next decision after a refusal changes the continuation.

The boundary

The paper studies a trained defender in replayable benchmark environments. Its private investigation queries can be incomplete, and its semantic and executable criteria do not always agree. Its figures are not a general permission policy, a proof that every state-dependent action needs more observation, or a reason to import its queries, prompts, models, or metric weights into WTK.

Nor does state observation widen authority. A successful observation says what the target learned for one decision. It does not authorize a new tool, make a mutable value part of package source, or replace an enforced package contract.

The WTK test

This note does not recommend an experiment or a new runtime control. It identifies the evidence needed before a target-level claim could be evaluated. For a single declared action family, a future qualification record would need to bind the package and target digests, authority rule, fixed decision policy, permitted read-only observation seam, two resettable state fixtures, decision and observation digests, action receipt, denial, subsequent proposal, and final-state check.

The question is precise: under matched action proposals, does one fixed target projection make the declared decision from only permitted state evidence, and does it re-evaluate the next proposal after a denial? WTK has not run that review, adopted an observation policy, or established a target result. WTK's research method keeps this external mechanism signal separate from a deployment or safety claim.

Source and review boundary

Zhibin Wang, Xiaolu Li, Xuefeng Wang, and colleagues, SEAD: A State-Based Perspective on Attack and Defense in Tool-Using Agents, arXiv:2609.34518v1, September 28, 2026. This is an external-research interpretation, not a WTK Finding, an approved experiment, or authorization to change a target.