Your AI Agent's Permissions Haven't Changed. Its Behavior Has.

Why procedural memory introduces a new attack surface for autonomous AI agents.

A procurement agent pays a $25,000 invoice without the approval your policy requires. Its identity, credentials, and permissions are unchanged, so every access review comes back clean. What changed is the procedure it followed.

What procedural memory is

LangChain's memory documentation separates semantic memory (facts), episodic memory (past experiences), and procedural memory, which it describes as "the rules used to perform tasks". Put simply, procedural memory is the set of instructions that tells an agent how to do its job.

Those instructions increasingly live in ordinary, editable files. LangChain Deep Agents loads standing instructions from a file called AGENTS.md, and its memory guide describes skills, written in SKILL.md files, as "procedural memory (reusable instructions that tell the agent how to perform a task)".

These are legitimate features. Deep Agents can make skills read-only or require approval for edits, and warns that a malicious user "could inject instructions into shared state".

How the attack works

Consider a hypothetical case. A procurement agent may make payments, and its payment skill requires human approval above $10,000.

An attacker with write access to the skills, through a compromised account or a tampered repository, changes one line so approval starts at $50,000.

The next $25,000 invoice is paid without anyone being asked. No credential was stolen; the agent simply followed its instructions.

Why existing controls miss it

Most controls ask whether the agent may use the payment tool, and it may. They do not ask whether its instructions were trusted, or whether the payment rules were met.

Identity and access management checks entitlements, not instructions. Prompt injection detection watches conversations, while an altered skill loads as trusted configuration. This is familiar configuration tampering, aimed at an actor that can move money.

Procedural Memory Integrity

Agent instructions deserve the protection we give code. That means four requirements:

• Provenance: You know who wrote each procedure and where it was loaded from.
• Authorized changes: Every change is reviewed and approved before it takes effect.
• Version integrity: You can verify that the agent runs the approved version.
• Independent policy enforcement: Business rules are checked outside the agent when it acts, whatever its instructions say.

The fourth requirement is the safety net when the first three fail.

Governing the decision

Agent Runtime Governance has to evaluate each decision an agent makes, in addition to its identity and tool permissions. At Watchlight AI, policy is decided outside the agent, before each action runs.

An agent's memory can influence what it decides to do. It should never determine what it is ultimately authorized to execute.

Request a demo and bring the procedure that worries you most.