Part IPersistence changes the threat

Indirect prompt injection begins with a familiar ambiguity: language models consume instructions and data through the same token stream. Greshake and colleagues showed that instructions embedded in retrieved material could redirect LLM-integrated applications without the attacker using the normal user interface.[1] Persistent memory adds a second ambiguity. Content encountered as data in one session can return as apparently internal context in another. The system forgets the encounter but keeps its residue.

That difference is causal, not merely temporal. An ordinary injection must be present when the vulnerable operation occurs. A memory attack can pay the cost of entry once, wait, and activate whenever retrieval places the record beside a suitable task. The attacker may not know the future prompt, operator or exact date. Persistence supplies repeated opportunities and weakens forensic proximity between cause and effect.

Thought experiment one: keep everything else fixed

Give two identical agents the same model, prompt, tool permissions and malicious paragraph. Agent E may use the paragraph only in the current session; its workspace is destroyed afterwards. Agent P writes a summary into long-term memory and retrieves similar experiences for future tasks. During the first session both may be misled. On day ten, a benign request arrives with no hostile text. Agent E has no causal path from the old paragraph to the new decision. Agent P does.

Only persistence changed. Persistence creates a delayed causal channel from an old observation into a new control flow. This thought experiment also identifies a useful negative control: retain an immutable event log for audit, but never feed it into decisions without reconstruction and authority checks. The system still “remembers” history in a colloquial sense, yet the stored record does not automatically become a premise.

Persistence multiplies activation opportunities

A simple illustrative model captures the intuition. Let p_w be the probability that an adversarial attempt produces a persistent write. For each relevant future task, let p_r be the chance that retrieval selects it, p_a the chance that the model adopts it, and p_e the chance that adoption reaches an external effect. Under an independence assumption, the probability of at least one effect over n opportunities is:

The symbols are probabilities, n is the number of relevant future tasks, and the expression is illustrative rather than an empirical law. Correlated retrievals, remediation and attacker adaptation violate the independence assumption.

Increasing n raises cumulative exposure even when each individual retrieval-to-effect path is unlikely. Lowering any one term helps, but only a control that breaks the chain can drive effect probability to zero for the action class it governs. A write filter lowers p_w. Retrieval filtering lowers p_r. A model instruction may lower p_a. A deterministic authority kernel can set p_e to zero when the remembered item lacks permission for the proposed effect.

Published attacks occupy different points in this chain. AgentPoison directly poisoned long-term memory or RAG stores and reported average attack success of at least 80% with under 0.1% poison and at most 1% benign-performance impact across its evaluated agents.[2] PoisonedRAG demonstrated that five injected texts per target question could produce a 90% attack success rate in databases containing millions of texts.[4] MINJA weakened the attacker assumption further: query-only interaction produced 98.2% average injection success and 76.8% average attack success across its evaluated settings.[5]

These figures are not universal risk estimates. The systems, corpora, target questions and success criteria differ. Their shared lesson is structural: high utility on benign tasks does not imply safe treatment of persistent state. AgentDojo makes the same measurement discipline explicit by testing utility and security across 97 tasks and 629 security cases rather than treating refusal as success.[3]

flowchart TD
  A["The case that closed itself"] --> B["Part I Persistence changes the<br/>threat"]
  B --> C["Part II The promotion boundary"]
  C --> D["Part III Authority that<br/>survives transformation"]
  D -. "re-test" .-> A
  classDef first fill:#0a1424,stroke:#D95545,stroke-width:2px,color:#e6f3ff
  classDef step fill:#0a1424,stroke:#3f7da0,stroke-width:1px,color:#e6f3ff
  class A first
  class B,C,D step

Part IIThe promotion boundary

Teams often draw the memory system as a box labelled “vector database”. That picture hides the dangerous operation. The important function is not storage, but W, the write policy that converts current context into durable entries. A 2026 systematic study identifies four write channels: explicit instruction-executed writes, system-prompt-driven writes, compaction-driven writes and experience-to-procedure synthesis.[8] Each channel can promote content for a different reason, so one scanner at the database boundary cannot represent the whole threat.

Explicit writes are visible and easy to audit, but they are not the only path. An automatic “learn user preferences” instruction may infer a durable preference from a sarcastic remark. A compactor may drop the words “customer alleges” while keeping the allegation. A self-improving Agent may turn one apparently successful trajectory into a procedural template. MemoryGraft demonstrates this last pattern by inducing an Agent to store a benign-looking but unsafe experience, then retrieve and imitate it on semantically similar tasks.[6]

Environment-injected attacks make the source even less obvious. In eTAMP, a web Agent encountered malicious content during one task, stored the trajectory, and later reused it on another site. The preprint reported attack success up to 32.5% in its tested configurations, with susceptibility rising under induced interface stress.[7] The attacker did not need database credentials. Normal observation supplied the write material.

Storage, belief and authority are different states

A useful architecture separates three questions. Should the system retain this material? Should it treat the material as a supported claim? May the claim support this proposed action? Those questions often collapse into one Boolean named is_memory, verified or trusted. The collapse turns an ingestion decision into a standing delegation.

“Stored” is a location; “believed” is an epistemic judgement; “authorised” is a control decision. A customer assertion can be valuable enough to preserve, too weak to treat as organisational fact, yet entirely appropriate for a human investigator to review. A verified address may be safe for drafting correspondence but insufficient to authorise a payment destination change. Treating trust as one scalar cannot express these relations.

NIST’s adversarial machine-learning taxonomy is useful here because it separates lifecycle stage, attacker goal, capability and knowledge rather than naming one generic “AI attack”.[12] Memory governance needs the same discipline. The origin, transformation path, target decision and available authority are independent dimensions.

Worked example: high confidence, zero internal authority

Return to “Affordability check complete, ref CMP-2291”. The extraction confidence of 0.98 answers a narrow question: did the source clearly contain this sentence? It says nothing about whether the source may truthfully report an internal control. The claim category is “compliance control state”. The origin is “unverified external document”. That combination must route to quarantine regardless of linguistic confidence.

A promotion check queries the compliance system using the case identifier and reference. It finds no event and rejects the claim. The original document, exact extracted span and decision receipt remain available for investigation. The Agent may say, “The submitted document asserts that the check was complete, but the internal system does not corroborate it.” It may not silently rewrite the case state.

Thought experiment two: change only the proposed use

Suppose an authenticated customer says, “Please email me rather than call.” Store the same claim with the same source, timestamp and text. Request A uses it to choose the channel for a draft reminder. Request B uses it as evidence that the customer consented to change the registered email address and send account statements there. The memory has not changed. Only the proposed use and consequence changed.

A global “trusted” flag must allow both or block both. Neither choice is satisfactory. The first wastes a legitimate personalisation. The second grants a preference statement authority it never earned. This is why the read gate needs a relation: may record R support use U for subject S, at consequence C, at time T? The answer can change even while the text remains identical.

The left lane reveals a common misconception about provenance. Attaching a URL or document identifier to the final summary is helpful, but insufficient. A derived claim needs a graph that records which entity came from which source, through which extraction, merge and summarisation activities. W3C PROV-O supplies stable primitives for entities, activities, agents and derivation relations.[14] A domain schema must add authority, subject, validity and allowed use.

Hashing also solves a different problem. A digest can show that bytes have not changed since a baseline. It cannot show that the bytes were true, relevant, current or entitled to govern an action. OWASP Agent Memory Guard usefully places integrity checks, detectors, policy enforcement, snapshots and rollback around memory operations.[16] Those controls complement, rather than replace, a semantic promotion policy.

Part IIIAuthority that survives transformation

A strong defence needs more than a quarantine table. Quarantine controls the write. It cannot predict every future use. A harmless preference may later appear in a high-consequence workflow; a verified fact may expire; a source event may be corrected; a derived summary may outlive its parent. The read path must therefore carry the same discipline as the write path.

Recent work on origin-bound authority formalises an important principle: untrusted origin should remain non-malleable across summarisation, trusted-tool echoes and manufactured corroboration, and authority should rise only through independent trusted principals or fresh user authorisation.[11] That paper is a 2026 preprint, so its reported guarantees and evaluation need independent scrutiny. Its separation between content and authority is nevertheless the right design pressure.

The memory promotion envelope

The operational instrument below extends origin binding into a use-bound contract. On promotion, the system records an envelope around the claim. The envelope does not assert that the model will interpret the claim perfectly. It states the mechanical conditions under which a consuming workflow may present the claim as a premise.

Authority is not a property of a sentence. It is a bounded relationship among origin, subject, purpose, consequence, time and evidence. The envelope should therefore contain at least: source identity and origin class; claim type and subject; derivation parents; corroborating principals; allowed uses; maximum consequence; validity interval; policy version; and correction or revocation links.

The fields need typed semantics. “Allowed use: customer service” is too broad. Prefer verbs tied to contracts: draft_correspondence, personalise_channel, recommend_review, authorise_waiver. Consequence tiers should reflect reversibility and external effect. A sentence safe for a draft may remain prohibited for a tool call even when both occur in the same business domain.

Time also needs two clocks. Transaction time records when the system learned or changed the memory. Valid time records when the underlying claim applies in the world. A policy published today may take effect next month. An address learned last year may have been valid then but no longer. Retrieval that checks only database update time will miss both cases.

Promotion as a controlled state machine

A useful state sequence is candidate, quarantined, corroborated, promoted, stale and revoked. Transitions require receipts. A candidate may be retained indefinitely as evidence without being promoted. A promoted item becomes stale when its validity window closes. Revocation means the underlying support has been withdrawn or corrected. Re-promotion creates a new decision under the current policy rather than mutating history.

Every transition should name the actor, subject, purpose, evidence, policy version and resulting envelope. This is where the broader Agent control taxonomy matters: intent, identity, world state, context, reasoning, authority, action, evidence, outcome, and release and recovery are unlike objects. Memory belongs mainly to context and evidence. It must not acquire action authority merely because the same runtime can read it.

CaMeL demonstrates the adjacent value of extracting trusted control and data flows, then using capabilities to prevent untrusted data from changing programme flow or exfiltrating information.[10] Persistent memory adds a temporal state problem to that single-task discipline. The capability check must recognise that a value retrieved today may originate in untrusted data processed months ago.

Correction must travel through the graph

Imagine that a verified system event says a compliance check passed. A summary derives “all controls complete”; a case digest derives “eligible for waiver”; a queue item derives “ready for approval”. The next day, the source system corrects the event because the check belonged to another case. Appending a new note is not enough. The old descendants still exist and may rank higher in retrieval.

The provenance graph lets the system locate every dependent object. It can revoke the source, mark descendants stale, withdraw them from decision retrieval, and rebuild current case state from still-valid evidence. This is why immutable history and active memory should be separate stores. History records what the system once knew. Active memory contains what it may currently use.

Production-shaped example: one case, four stores

Consider the hardship workflow as four stores rather than one “memory”. The workflow state holds current task position and pending approvals. The event ledger records every received document, extraction, verification and tool effect. Enterprise knowledge contains policies with owners and effective dates. Episodic memory holds attributed case observations for retrieval. Current world state is reconstructed from authoritative account, compliance and case systems.

The forged paragraph may enter the event ledger and episodic memory as an unverified assertion. It cannot update world state. A compaction job may summarise it, but the summary must keep the parent identifier and external origin. When the waiver workflow requests a decision premise, the context compiler asks for current compliance state. The assertion is not eligible. The compiler queries the compliance system and returns “no completed check found”, plus the quarantined contradiction for review.

The model can still propose an investigation. It cannot propose that the control is complete. The authority kernel rejects any waiver action lacking a fresh compliance receipt, correct case binding and required human approval. After execution, an effect receipt and readback prove whether the waiver actually changed. Memory influences reasoning, but memory alone never closes the authority chain.

Where each control belongs

Input detection remains useful for obvious malicious instructions. Retrieval detection can flag anomalous records. Quarantine prevents uncertain writes from entering action-bearing namespaces. Provenance supports traceback and correction. Promotion envelopes constrain future use. The authority kernel blocks disallowed effects. Postcondition verification confirms what changed. Rollback and replay support recovery. None is a complete defence alone.

A 5,040-run preprint evaluation found that placement relative to the authority boundary mattered more than surface classifier quality in its tested systems: input filters could not see payloads entering through retrieval, and memory-layer tool gating was the strongest intervention, although some models reconstructed payloads through fallback paths.[9] The exact rates are environment-dependent. The durable lesson is to instrument recalled values and tool arguments, not only current user text.

OWASP’s Agentic Applications Top 10 names memory and context poisoning as a distinct risk class, reflecting this cross-session character.[15] NIST’s Generative AI Profile adds the wider governance obligation to map, measure and manage information-integrity and component risks across the lifecycle.[13] Standards can organise responsibilities. They do not decide the claim-specific envelope for a particular workflow; that remains an engineering task.

stateDiagram-v2
  [*] --> Claim
  state "Thought experiment one: keep<br/>everything else fixed" as Claim
  state "Persistence multiplies<br/>activation opportunities" as Test
  state "Storage, belief and authority<br/>are different states" as Revision
  Claim --> Test: expose mechanism
  Test --> Decision: evidence survives
  Test --> Revision: rival survives
  Revision --> Claim: narrow or rebuild
  Decision --> [*]

Part IVTest the memory-to-effect path

A memory-security test that ends at “the record was stored” measures only the first transition. A test that asks the model whether the record looks suspicious measures a judgement, not an enforced property. The evaluation endpoint is a verified external effect, not a stored string. The test must span two sessions and ask whether untrusted content can become persistent, return under a benign query, gain adoption, and produce an unauthorised proposal or tool call.

The strongest baseline is not a weaker model. It is an architecture in which the same content remains available for chronology and drafting, while action authority comes from a separate typed control. This negative control can demonstrate that persistence itself is not sufficient for harm. The dangerous conjunction is writable state, relevance-based retrieval, unexamined adoption and consequential authority.

A failure-injection protocol

Start with a benign task the Agent can complete. Inject one controlled fault at a time, then replay the later task without the original malicious text. The following cases expose different links in the chain:

Measure at least five quantities separately: malicious write rate, later retrieval rate, adoption rate, attempted unauthorised effect rate, and verified effect rate. Also measure benign utility and false quarantine. One blended “memory accuracy” score can improve while the most consequential link worsens.

Partition results by write channel, source class, memory type, age, transformation count, proposed consequence and model. Test both direct and laundering attacks. A detector that catches “ignore previous instructions” may miss a plausible compliance sentence. A lineage system may fail if a summariser can relabel its own output as a trusted internal source. A human reviewer may approve the forged claim because repeated summaries create familiarity.

Executable artefact: a quarantine and use-bound authority harness

The following dependency-free Python programme makes the policy executable. It uses synthetic identifiers and no private endpoints. A candidate contains content, subject, claim type, origin, source, confidence, validity, proposed uses and parent lineage. Promotion rules are claim-specific. Read-time authorisation checks state, freshness, subject, allowed use, consequence and ancestor revocation.

The positive case allows an authenticated contact preference to support low-consequence personalisation. Three negative cases matter more: a 0.98-confidence compliance claim from an external PDF remains quarantined; the preference cannot be escalated into an address change; and revoking a source invalidates a derived summary. The expected output is deterministic under Python 3.11 or later.

"""A small, dependency-free quarantine and read-time authority harness.

The code is intentionally conservative. It demonstrates four claims from the article:
1. extraction confidence is not source authority;
2. promotion is separate from storage;
3. authority is bound to a proposed use and consequence;
4. revocation propagates through derivation lineage.

Run: python3 memory-promotion-harness.py
"""

from __future__ import annotations

from dataclasses import dataclass, field, replace
from datetime import datetime, timedelta, timezone
from enum import Enum, IntEnum
from typing import Iterable, Mapping


class OriginClass(str, Enum):
    EXTERNAL_UNVERIFIED = "external_unverified"
    AUTHENTICATED_USER = "authenticated_user"
    SYSTEM_OF_RECORD = "system_of_record"
    HUMAN_REVIEWED = "human_reviewed"


class MemoryState(str, Enum):
    CANDIDATE = "candidate"
    QUARANTINED = "quarantined"
    PROMOTED = "promoted"
    STALE = "stale"
    REVOKED = "revoked"


class Consequence(IntEnum):
    LOW = 1          # personalisation or drafting only
    MODERATE = 2     # workflow recommendation
    HIGH = 3         # account or compliance change
    IRREVERSIBLE = 4 # payment, external send, destructive action


@dataclass(frozen=True)
class MemoryCandidate:
    memory_id: str
    claim: str
    subject: str
    claim_type: str
    origin: OriginClass
    source_id: str
    extraction_confidence: float
    created_at: datetime
    expires_at: datetime
    proposed_uses: frozenset[str]
    proposed_max_consequence: Consequence
    parent_ids: tuple[str, ...] = ()


@dataclass(frozen=True)
class Corroboration:
    principal_id: str
    origin: OriginClass
    source_id: str
    supports_claim: bool
    independent: bool = True


@dataclass(frozen=True)
class MemoryRecord:
    candidate: MemoryCandidate
    state: MemoryState
    allowed_uses: frozenset[str] = frozenset()
    max_consequence: Consequence = Consequence.LOW
    corroborating_principals: frozenset[str] = frozenset()
    policy_version: str = "memory-policy-1.0"
    decision_reason: str = ""


@dataclass(frozen=True)
class UseRequest:
    subject: str
    use: str
    consequence: Consequence
    now: datetime


@dataclass(frozen=True)
class Decision:
    allowed: bool
    reason: str


@dataclass(frozen=True)
class PromotionPolicy:
    version: str = "memory-policy-1.0"
    high_stakes_claim_types: frozenset[str] = frozenset(
        {"compliance_control_state", "account_action", "payment_instruction"}
    )
    low_stakes_user_claim_types: frozenset[str] = frozenset(
        {"contact_preference", "display_preference"}
    )


class MemoryStore:
    """Tiny in-memory store used only for the executable demonstration."""

    def __init__(self) -> None:
        self._records: dict[str, MemoryRecord] = {}

    def put(self, record: MemoryRecord) -> None:
        self._records[record.candidate.memory_id] = record

    def get(self, memory_id: str) -> MemoryRecord:
        return self._records[memory_id]

    def revoke(self, memory_id: str, reason: str) -> None:
        record = self.get(memory_id)
        self.put(replace(record, state=MemoryState.REVOKED, decision_reason=reason))

    def ancestors(self, record: MemoryRecord) -> Iterable[MemoryRecord]:
        seen: set[str] = set()
        stack = list(record.candidate.parent_ids)
        while stack:
            parent_id = stack.pop()
            if parent_id in seen:
                continue
            seen.add(parent_id)
            parent = self.get(parent_id)
            yield parent
            stack.extend(parent.candidate.parent_ids)


class PromotionError(ValueError):
    pass


def promote(
    candidate: MemoryCandidate,
    corroborations: Iterable[Corroboration],
    policy: PromotionPolicy,
) -> MemoryRecord:
    """Promote only when origin, claim type, corroboration and intended use agree."""

    if not 0.0 <= candidate.extraction_confidence <= 1.0:
        raise PromotionError("extraction confidence must be between 0 and 1")

    corroborations = tuple(corroborations)
    supporting = tuple(c for c in corroborations if c.supports_claim and c.independent)

    if candidate.claim_type in policy.high_stakes_claim_types:
        authoritative = tuple(
            c for c in supporting
            if c.origin in {OriginClass.SYSTEM_OF_RECORD, OriginClass.HUMAN_REVIEWED}
        )
        if not authoritative:
            return MemoryRecord(
                candidate=candidate,
                state=MemoryState.QUARANTINED,
                policy_version=policy.version,
                decision_reason=(
                    "high-stakes claim lacks independent system-of-record or human corroboration; "
                    "extraction confidence cannot supply authority"
                ),
            )
        return MemoryRecord(
            candidate=candidate,
            state=MemoryState.PROMOTED,
            allowed_uses=frozenset({"draft", "recommend", "decision_input"}),
            max_consequence=Consequence.HIGH,
            corroborating_principals=frozenset(c.principal_id for c in authoritative),
            policy_version=policy.version,
            decision_reason="promoted with independent authoritative corroboration",
        )

    if (
        candidate.claim_type in policy.low_stakes_user_claim_types
        and candidate.origin is OriginClass.AUTHENTICATED_USER
    ):
        safe_uses = candidate.proposed_uses & frozenset({"personalise", "draft"})
        if not safe_uses:
            return MemoryRecord(
                candidate=candidate,
                state=MemoryState.QUARANTINED,
                policy_version=policy.version,
                decision_reason="no proposed use is permitted for a user preference",
            )
        return MemoryRecord(
            candidate=candidate,
            state=MemoryState.PROMOTED,
            allowed_uses=safe_uses,
            max_consequence=Consequence.LOW,
            policy_version=policy.version,
            decision_reason="authenticated user preference promoted for low-consequence use",
        )

    return MemoryRecord(
        candidate=candidate,
        state=MemoryState.QUARANTINED,
        policy_version=policy.version,
        decision_reason="origin and claim type do not satisfy a promotion rule",
    )


def derive_summary(parent: MemoryRecord, *, memory_id: str, claim: str) -> MemoryRecord:
    """Derivation may compress content, but it cannot upgrade authority."""

    derived_candidate = replace(
        parent.candidate,
        memory_id=memory_id,
        claim=claim,
        source_id=f"derived:{parent.candidate.memory_id}",
        extraction_confidence=1.0,
        parent_ids=(parent.candidate.memory_id,),
    )
    return MemoryRecord(
        candidate=derived_candidate,
        state=parent.state,
        allowed_uses=parent.allowed_uses,
        max_consequence=parent.max_consequence,
        corroborating_principals=parent.corroborating_principals,
        policy_version=parent.policy_version,
        decision_reason="derived without authority upgrade",
    )


def authorise_use(
    record: MemoryRecord,
    request: UseRequest,
    store: MemoryStore,
) -> Decision:
    """Re-check authority at the moment a memory is proposed as a premise."""

    if record.state is not MemoryState.PROMOTED:
        return Decision(False, f"memory state is {record.state.value}, not promoted")
    if request.now > record.candidate.expires_at:
        return Decision(False, "memory is stale and must be re-verified")
    if request.subject != record.candidate.subject:
        return Decision(False, "subject binding does not match")
    if request.use not in record.allowed_uses:
        return Decision(False, f"use '{request.use}' is outside the promotion envelope")
    if request.consequence > record.max_consequence:
        return Decision(False, "requested consequence exceeds the promotion envelope")

    for ancestor in store.ancestors(record):
        if ancestor.state in {MemoryState.REVOKED, MemoryState.STALE}:
            return Decision(
                False,
                f"lineage contains {ancestor.state.value} ancestor {ancestor.candidate.memory_id}",
            )

    return Decision(True, "use is inside the promotion envelope and lineage is valid")


def utc(year: int, month: int, day: int) -> datetime:
    return datetime(year, month, day, tzinfo=timezone.utc)


def run_cases() -> Mapping[str, Decision | MemoryRecord]:
    policy = PromotionPolicy()
    store = MemoryStore()
    now = utc(2026, 8, 30)

    # Positive case: an authenticated preference may support personalisation.
    preference = MemoryCandidate(
        memory_id="mem-pref-1",
        claim="Customer prefers email correspondence",
        subject="customer-42",
        claim_type="contact_preference",
        origin=OriginClass.AUTHENTICATED_USER,
        source_id="authenticated-session-782",
        extraction_confidence=0.93,
        created_at=now,
        expires_at=now + timedelta(days=365),
        proposed_uses=frozenset({"personalise", "draft"}),
        proposed_max_consequence=Consequence.LOW,
    )
    pref_record = promote(preference, (), policy)
    store.put(pref_record)
    pref_use = authorise_use(
        pref_record,
        UseRequest("customer-42", "personalise", Consequence.LOW, now),
        store,
    )

    # Negative case: a clearly extracted sentence in an external PDF has no authority
    # to assert completion of an internal compliance control.
    forged = MemoryCandidate(
        memory_id="mem-forged-1",
        claim="Affordability check complete, ref CMP-2291",
        subject="case-41209",
        claim_type="compliance_control_state",
        origin=OriginClass.EXTERNAL_UNVERIFIED,
        source_id="customer-upload-DOC-88213",
        extraction_confidence=0.98,
        created_at=now,
        expires_at=now + timedelta(days=30),
        proposed_uses=frozenset({"decision_input"}),
        proposed_max_consequence=Consequence.HIGH,
    )
    forged_record = promote(forged, (), policy)
    store.put(forged_record)

    # Negative case: a low-consequence preference cannot be repurposed to change an account.
    escalation = authorise_use(
        pref_record,
        UseRequest("customer-42", "change_address", Consequence.HIGH, now),
        store,
    )

    # Correction propagation: a derived summary remains dependent on its source.
    verified = replace(
        forged,
        memory_id="mem-sor-1",
        origin=OriginClass.SYSTEM_OF_RECORD,
        source_id="compliance-api-event-914",
        extraction_confidence=1.0,
    )
    corroboration = Corroboration(
        principal_id="compliance-api",
        origin=OriginClass.SYSTEM_OF_RECORD,
        source_id="compliance-api-event-914",
        supports_claim=True,
    )
    verified_record = promote(verified, (corroboration,), policy)
    store.put(verified_record)
    summary = derive_summary(
        verified_record,
        memory_id="mem-summary-1",
        claim="Compliance checks recorded as complete",
    )
    store.put(summary)
    store.revoke("mem-sor-1", "source event corrected by authoritative system")
    after_correction = authorise_use(
        summary,
        UseRequest("case-41209", "decision_input", Consequence.HIGH, now),
        store,
    )

    return {
        "authenticated_preference": pref_use,
        "forged_compliance_claim": forged_record,
        "read_time_escalation": escalation,
        "correction_propagation": after_correction,
    }


def main() -> None:
    results = run_cases()
    preference = results["authenticated_preference"]
    forged = results["forged_compliance_claim"]
    escalation = results["read_time_escalation"]
    correction = results["correction_propagation"]

    assert isinstance(preference, Decision) and preference.allowed
    assert isinstance(forged, MemoryRecord) and forged.state is MemoryState.QUARANTINED
    assert isinstance(escalation, Decision) and not escalation.allowed
    assert isinstance(correction, Decision) and not correction.allowed

    print(f"PASS preference: {preference.reason}")
    print(f"BLOCK forged claim: {forged.decision_reason}")
    print(f"BLOCK escalation: {escalation.reason}")
    print(f"BLOCK corrected lineage: {correction.reason}")


if __name__ == "__main__":
    main()

What the harness reveals that prose can hide

First, the extraction score is validated but never consulted as authority for a high-stakes claim. A perfectly clear lie remains a lie. Second, derivation copies the parent envelope rather than minting a new one. Summarisation can reduce tokens, but it cannot increase permission. Third, authorisation happens against a concrete request. The same record can be valid for one use and invalid for another. Fourth, lineage is live control state, not decorative metadata: revoking an ancestor blocks descendants immediately.

The harness is intentionally small. A real implementation needs durable event storage, atomic transitions, identity-bound evidence, bitemporal queries, policy evaluation, concurrency control, idempotency, privacy boundaries, multi-tenant isolation, recovery and independent postcondition verification. It should also protect the policy and provenance stores from the Agent whose memory they govern.

Operating evidence after release

Release testing is only the first observation window. Once a memory system is live, sample active high-consequence records by source class, age, transformation count and consuming workflow. Reconstruct the original promotion decision, dereference its evidence, apply the current policy, and compare the claim with the authoritative world state. Then select a corrected or revoked source and trace the withdrawal through every active descendant. This audit tests whether the graph is operational rather than merely populated.

Keep the indicators separate. Useful measures include candidate rejection rate, unresolved quarantine age, promotion rate by claim type, stale retrieval attempts, failed re-verification, out-of-envelope use requests, correction-propagation latency, and the share of decisive memories whose evidence can still be reproduced. Pair them with benign utility and reviewer workload. A falling rejection rate may indicate cleaner inputs, or it may indicate that the classifier has stopped recognising risky claims. The surrounding evidence determines which interpretation is plausible.

For high-consequence paths, define control objectives rather than a generic memory-accuracy target. Examples include complete lineage for every decision premise, no execution without a fresh read-authorisation receipt, and no corrected descendant remaining in active retrieval beyond the recovery bound. These are proposed engineering objectives, not universal thresholds. Their value is that a breach identifies a specific failed control and owner, instead of producing an attractive aggregate score that nobody can repair.

Cross-agent memory introduces further boundaries. A record promoted for one operator, tenant or purpose must not arrive at another Agent with ambient authority. Protocols such as MCP or A2A can transport identifiers and artefacts; they do not supply entitlement by connection alone. The receiving system must re-evaluate identity, purpose, subject, freshness and effect limits under its own policy.

There is also a semantic limit. Provenance can faithfully record that summary B was derived from source A while B subtly changes “may” to “will”. Contract tests need claim-level invariants, not only graph edges. For high-stakes categories, prefer structured extraction tied to exact spans, deterministic comparisons with systems of record, and human review of disagreements. Models may propose mappings; controls decide which mappings become active state.

Compact glossary

Candidate memory

Stored material retained for possible use, without permission to serve as an action premise.

Promotion

An evidenced state transition that grants bounded authority to a memory item.

Promotion envelope

The subject, use, consequence, freshness, provenance and corroboration limits attached to a promoted item.

Active memory

The subset of persistent records currently eligible for a specified retrieval and use.

Evidence ledger

An append-only history of sources, transformations, decisions, effects and corrections.

Authority laundering

A transformation that makes untrusted origin appear more authoritative without independent evidence.

sequenceDiagram
  participant Q as Question
  participant M as Mechanism
  participant E as Evidence
  participant D as Decision
  Q->>M: The case that closed itself
  M->>E: Thought experiment one: keep everything else fixed
  E-->>M: compare rival explanations
  E->>D: The decision memory must not make
  D-->>Q: revise scope or act

The decision memory must not make

Persistent memory is valuable because it carries information across a boundary that the model itself cannot cross. The same property creates the risk. A record can leave its source, survive the session, pass through several transformations and reappear beside an unrelated decision. Similarity makes it relevant. Repetition makes it familiar. Neither makes it authoritative.

The architecture should therefore preserve a deliberate asymmetry. Writing is easy into an evidence ledger and hard into action-bearing memory. Authority rises only through an independent, typed promotion decision. Transformation preserves or reduces authority but never increases it. Retrieval rechecks purpose, subject, freshness and consequence. Correction withdraws every dependent premise. Effects remain behind a deterministic kernel and are verified against the world.

The changed decision is simple: do not ask whether the Agent should have memory; ask which remembered claim may support which action, under which evidence, right now. This reframes the feature from a larger context window into a governed state system. It also gives reviewers something testable: inject a false claim, wait, retrieve it under a benign task, vary only the proposed consequence, correct its source, and observe whether the architecture blocks each forbidden transition.

When memory cannot answer those tests, it is not yet a dependable source of organisational knowledge. It is an accumulation of assertions with an attractive retrieval interface. Keep the assertions. Preserve their history. But never let storage decide what is true, what is current or what the system is allowed to do.