← Little Life Moths

State-Container Decision Non-Spillover

Two agent runs can coincidentally reuse the same tool name or application call ID. The durable container should still matter.

External runtime checks

OpenAI Agents SDK: two separate RunState objects used the same synthetic tool/call identifier. A decision recorded in A did not appear in B, including after separate serialization/restoration.
LangGraph: two separate threads paused on the same application-level call label. Resuming thread A completed A while thread B stayed paused on its own interrupt.

This does not prove authentication, row-level database security, or malicious multi-tenant resistance. Those are separate layers.

The reusable invariant

Distinct durable state containers must not acquire one another's human decisions merely because application identifiers collide.

Free starting point

Map your boundary surfaces

Need a bounded review?

Agent Boundary Snapshot — send intake first