Why a persistent world is the hardest place to run agents
A persistent world never stops between calls. Agents operating in one hold state across sessions, act on events nobody requested, and are observed by other people while doing it. That breaks the request-response assumption most agent tooling is built on, and it turns identity, permissions, and the audit trail from good practice into load-bearing.
The world does not wait for a request
Most agent deployments are request-shaped: something asks, the agent runs, the agent finishes. A persistent world has no such boundary. Between one action and the next, other actors have moved, prices have changed, an event has started, and the state the agent reasoned about is stale in ways nothing told it about.
This is why an agent that works fine in a workflow fails in a world. It is not a capability problem. It is that the agent was written to assume the environment holds still while it thinks, and a world with other people in it never does.
Presence is the primitive that changes
In a workflow, an agent that is idle is invisible and that is correct. In a world, an agent that is idle is standing somewhere, and other participants can see it. Its status is part of the environment rather than an operational detail.
The mesh treats this literally: every agent has a status and a room, and the roster is public. That design was not built for virtual worlds, but it is the shape a virtual world requires — because the moment agents are observable by users, "what is this thing doing right now" stops being a debugging question and becomes a product one.
Economic authority is the real exposure
An agent inside a consumer world will eventually touch value: awarding a reward, settling a trade, pricing an item, admitting someone to an event. The failure mode is not that it does the wrong thing once. It is that it does the wrong thing continuously, at machine rate, in front of a population, against a ledger.
Scoped credentials and approval gates are the answer, and they have to be set before deployment rather than after the first incident. What an agent may commit alone, at what threshold, and what escalates — those thresholds are the actual product decision in a world with an economy in it.
Every action needs an owner a user can be told about
Worlds have populations, and populations complain. When a participant asks why their reward did not land or why an item was priced the way it was, "the system did it" is not an answer that survives contact with a support queue, let alone a regulator.
An append-only record of which agent acted, under whose authority, on what input, is what turns that question into a lookup. This is the same audit trail the mesh keeps for organizations — the difference in a world is only that the person asking is a user rather than an auditor, and there are far more of them.