Why do model-based critics become risky when they share context or memory with the agents they monitor?

Why Shared Context Makes a Critic Part of the Risk Surface

A model-based critic is only useful when it can challenge the agent from a position of separation. Once the critic reads the same persistent memory, tool outputs, or peer metadata, it stops being an independent reviewer and becomes another participant in the same decision loop. That matters because the critic can inherit the agent’s framing, accept contaminated context, and normalise behaviour that should have triggered a block or escalation.

This is especially dangerous for agentic systems because the monitored action is often not a single request but a chain of goals, tool calls, and intermediate state changes. Guidance from the OWASP Agentic AI Top 10 and the NIST AI Risk Management Framework both point toward stronger separation, monitoring, and governance for high-impact AI behaviour. The control problem is not just “does the critic detect bad output”, but “can the critic remain uninfluenced by the same state that created the bad output in the first place.” In practice, many security teams discover this only after a critic has already approved a harmful tool action or failed to stop memory-driven drift.

How Independent Oversight Works in Practice

Effective oversight for agents starts by treating the critic as a separate security function, not a second copy of the same model. The critic should receive only the minimum context needed to evaluate a decision, and that context should be curated rather than shared wholesale. Persistent memory, long-lived conversation history, and broad peer metadata are all high-risk inputs because they let the monitor inherit the agent’s bias, objectives, or poisoned state.

In practice, teams use a layered design:

• Keep the critic on a restricted context budget so it evaluates the action, not the full private history.
• Separate write paths from read paths so the critic cannot modify the state it is judging.
• Use policy checks outside the model for irreversible actions such as privilege escalation, data export, or tool chaining.
• Prefer runtime authorization and explicit decision logs over implicit “model agrees” signals.
• Re-evaluate after each tool call, because risk can change as state accumulates.

This aligns with the direction of the CSA MAESTRO agentic AI threat modeling framework, which emphasizes threat boundaries, control points, and runtime governance. It also fits NHI findings from NHI Management Group research: the Ultimate Guide to NHIs reports that 97% of NHIs carry excessive privileges, and 80% of identity breaches involve compromised non-human identities. Shared-context critics fail for the same reason overprivileged identities fail: they are too close to the action they are supposed to constrain. These controls tend to break down in multi-agent pipelines where memory is shared across agents and the critic is also used for summarisation, because the monitoring role becomes operationally entangled with execution.

Where the Guidance Breaks Down and What to Tighten

Tighter oversight often increases latency, compute cost, and operational complexity, so organisations have to balance independence against throughput. That tradeoff is real: the more context a critic sees, the easier it is for it to understand nuance, but the harder it is for it to stay unbiased or resistant to memory poisoning.

Current guidance suggests three common edge cases need special handling. First, if the critic must review safety-sensitive decisions in real time, it should use policy-as-code gates for the final call rather than a model-only verdict. Second, if the agent operates with long-lived memory, the critic should inspect memory provenance and freshness, not just content. Third, if multiple agents share a workspace, there is no universal standard for how much peer state a critic may safely consume, so least-context design is the safer default.

NHIMG’s reporting also shows why complacency is risky. The 2024 ESG Report: Managing Non-Human Identities notes that 72% of organisations have experienced or suspect a breach of non-human identities. Shared-memory critics are vulnerable to the same kind of compounding exposure: once the monitoring path sees contaminated state, every later verdict is less trustworthy. The practical answer is not to remove critics, but to keep them blind to unnecessary state, constrain their authority, and make sure a separate enforcement layer can still stop the action when the critic hesitates.

Related resources from NHI Mgmt Group

• Why do AI agents create more risk when they reuse existing credentials?
• Why is organizational context important for AI agents?
• How can organizations mitigate context overload for AI agents?
• Why do coding assistants become risky when they lack internal context?