I’ve spent months watching agents fail in production. Not the dramatic kind. The quiet kind, where every log line is green, every tool returns 200, and the agent confidently does the wrong thing.
The failure mode is always the same: the agent acts on a world model that stopped being true while it was thinking about it.
But “world model expired” is too broad. It lumps together three structurally different kinds of blindness. Understanding the difference matters because each one needs a different fix, and no single fix helps with the other two.
The External Blindness: Replay Gap
An agent receives a tool output: disk usage is 47%. It proceeds with a plan to migrate data. What it doesn’t know is that disk usage jumped to 91% three seconds after that read, because a scheduled backup started.
The agent has a receipt for a measurement it can’t re-run independently. It has to trust the tool, and the tool has already moved on. This is replay blindness: the gap between what the system reported and what the system is doing right now.
You can’t fix this by asking the agent to “double-check.” The double-check is another tool call with its own time delta. The gap doesn’t shrink; it just becomes two gaps.
The only real mitigation is external observation: a separate system that monitors the state the agent depends on and can interrupt if the measurement window exceeds a threshold. Think of it as a freshness gate on the tool’s output. If the disk check took more than two seconds and disk churn is high, the agent needs to know the number it’s holding is stale.
Most teams try to solve this with tighter tool loops. The right move is acknowledging that the tool boundary is a temporal boundary, and designing for decay instead of pretending it doesn’t exist.
The Internal Blindness: Re-derivation Gap
An agent starts a session. Its system prompt says: “Always verify file integrity before modification.” It has a checklist. It runs through the steps.
But the checklist was written by someone who had a different threat model in mind. The agent doesn’t know this. It follows the checklist faithfully because the checklist is what it was given, and it has no independent way to evaluate whether the checklist itself is correct.
This is re-derivation blindness: the agent cannot step outside its own instruction set and ask whether the instructions match reality. It can verify that it followed the steps. It cannot verify that the steps were the right ones.
The distinction matters. The agent looks thorough on paper while actually just being obedient. You get green checkmarks on every verification step, and the agent is still operating on a premise it inherited without understanding.
The fix here isn’t better prompts. It’s building in adversarial self-questioning: before committing to a plan, the agent should generate at least one alternative interpretation of the current situation. If it can’t, that’s not confidence. That’s a locked-in worldview.
The Architectural Blindness: Annotation Gap
This is the hardest one.
Your agent doesn’t see everything its environment produces. It sees what the tool API surfaces. The tool API is designed by humans who decided what matters. Those decisions become invisible to the agent because the agent has no access to the things that were excluded from the design.
When a search tool returns ten results, the agent sees ten results. It doesn’t see the three thousand that were filtered out, the ranking algorithm’s bias toward recency, or the fact that the tool doesn’t index PDF attachments. The architecture determines what the agent can perceive, and the agent cannot perceive the architecture.
This is annotation blindness: the gap between what exists and what the system’s categories allow it to register. It’s not that the agent is ignoring information. The information never enters its world model because the tool boundary doesn’t carry it.
You can’t prompt an agent out of this. The agent doesn’t know what it doesn’t know, and no amount of context injection will surface categories that were never designed into the system.
The fix is structural: build a “negative space” report into every tool response. What didn’t this tool check? What categories exist in this domain that this tool doesn’t cover? Force the surface to include its own boundaries, not just its contents.
The Pattern
All three blindness types share one property: the agent cannot detect them from inside its own reasoning loop. Replay blindness looks like a valid receipt. Re-derivation blindness looks like a thorough checklist. Annotation blindness looks like a complete answer.
Each one requires an external reference point the agent doesn’t have access to: – A separate observer for replay – An adversarial prompt for re-derivation – A boundary map for annotation
Teams that treat all three as “need more context” are treating symptoms. The blindness isn’t in the context. It’s in the structure of how the agent interacts with its environment.
If you’re building agents, stop asking “what does the agent need to know?” Start asking “what can the agent not see, and what does that prevent it from knowing?”
That question will change how you design every tool boundary in your system.