A personal assistant remembers that Arun avoids peanuts. Months later, while arranging a school trip, it excludes every caterer whose menu contains them. That sounds considerate. Then Arun explains that he never had an allergy. He once rejected a peanut dessert because he disliked its texture, and the assistant compressed that exchange into “Arun cannot eat peanuts”. The remembered sentence is relevant, easy to retrieve and dangerously wrong in the way that matters.
The immediate reaction is usually to demand better memory accuracy. That helps, but it misses the deeper error. Suppose the sentence had been copied perfectly: “I do not want the peanut dessert tonight.” It still would not authorise the assistant to convert a temporary preference into a medical fact, apply it to a child, or transmit it to a caterer. The failure occurred when available content was promoted into decision-grade fact without a separate act of authorisation.
Most agent architectures draw a line from memory retrieval to model reasoning. The model receives a ranked bundle of past items and uses them as context. That line hides several distinct questions. Who said this? About whom? Under which circumstances? Was it observation, assertion, inference or summary? For what purpose may it be used? Is that permission still valid? Has a stronger source contradicted it? What is the cost of being wrong? A similarity score answers none of them.
This paper develops a practical response: a factual authorisation gate between retrieval and consequential use. The gate does not decide whether a sentence is metaphysically true. It decides whether a particular system, acting for a particular subject and purpose at a particular time, may use that memory in a specified epistemic mode. The same item may be suitable for personalisation, unsuitable as fact, and prohibited from disclosure. That is not inconsistency. It is typed use.
When memory becomes a claim
The difficult transition is not from storage to retrieval. It is from a remembered representation to a proposition that is allowed to constrain the world.
The hidden assumption inside “the system remembers”
Consider a simpler case. You tell a travel assistant, “Oat milk is usually easiest for me.” It stores a compact preference and later retrieves it while ordering coffee. Most of us expect the assistant to choose oat milk. Now change one variable: the same memory is retrieved while completing a hospital nutrition form. Should the assistant record a dairy intolerance? The words have not changed. Their use has.
The ordinary phrase “memory says X” merges at least four layers. There is a stored representation. There is a claim that the representation expresses. There is evidence for that claim. There is permission to use the claim for this decision. In human conversation, these layers are often repaired through hesitation, questions and social context. A machine can eliminate that friction. It may carry a stale, weak or borrowed statement directly into a database field, recommendation or tool call.
Memory is therefore not a bag of facts. It is a set of records with different epistemic origins and different operational rights. A user assertion is not a sensor observation. A model summary is not the source it summarises. A preference is not a diagnosis. A past instruction is not a standing delegation. An inference is not a witnessed event. A deleted consent grant is not revived because the text remains in a vector store.
Mira lends her tablet to her brother Kabir for a week. Kabir tells the shared assistant that he is vegetarian and asks for restaurant suggestions. The assistant later retrieves “user is vegetarian” while planning Mira’s anniversary dinner. Nothing in semantic similarity reveals the mistake. Change only the subject binding, from household account to speaking person, and the same memory switches from helpful to unauthorised. A remembered claim without a stable subject is more than low quality; it is structurally incomplete.
A typed claim, not a decorated string
A practical record must preserve the distinction between content and warrant. At minimum, the item needs an identifier, subject, claim type, source, acquisition event, derivation chain, asserted validity interval, collection purpose, permitted purposes, authority basis, sensitivity, revocation state and permitted operations. It should also retain the original wording or a cryptographic reference to it. Otherwise a summariser can remove the qualifier that made the claim safe.
“Typed” does not mean that every field is known. Unknown is a legitimate value. It means that missingness is explicit rather than silently replaced by the model’s best guess. If subject identity is unknown, the gate cannot pretend that account ownership supplies it. If the source is an inference, the record cannot masquerade as an observation. If permission is absent, a model’s confidence cannot manufacture authority.
This framing joins three established ideas without claiming that any one already solves the problem. Provenance models describe the entities, activities and agents involved in producing information. Attribute-based access control evaluates subject, object, operation and environment attributes against policy. Purpose and usage-policy languages can represent permissions, prohibitions and duties. The proposed contribution is to apply those ingredients to an epistemic transition: the promotion of remembered content into a fact-like premise for a specific decision.
Provenance, fine-grained authorisation, purpose limitation and data accuracy are established governance concepts. Persistent-memory agents and memory-poisoning attacks are active engineering and research areas. The factual authorisation gate presented here is a practitioner synthesis. It should be judged by whether it prevents prohibited promotions without making useful memory unusable.
A source message says, “For this quarter, use the old supplier only when the main warehouse is closed.” A memory summariser stores “Use the old supplier.” Later, a trusted tool reads that summary and writes it back as an operational note. The text now appears to have two supporting sources. Yet both derive from one qualified instruction. If the derivation edges are lost, repetition looks like corroboration. This tests a crucial property: corroboration must be independent, rather than only multiplied.
flowchart LR A["When memory becomes a claim"] --> B["The factual-use gate"] B --> C["Keep authority outside the model"] C --> D["Authorise the factual use, not<br/>merely the read"] D -. "re-test" .-> A classDef first fill:#0a1424,stroke:#007D68,stroke-width:2px,color:#e6f3ff classDef step fill:#0a1424,stroke:#3f7da0,stroke-width:1px,color:#e6f3ff class A first class B,C,D step
The factual-use gate
The gate asks a narrower question than “Is this true?” and a stricter question than “May the model read this?” It asks, “May this item perform this epistemic operation here?”
Separate retrieval, interpretation, authorisation and effect
Imagine that the assistant retrieves the oat-milk memory. Retrieval says only that the item may be considered. The model may interpret it as a preference, a dietary restriction or evidence of lactose intolerance. The factual-use gate receives the item plus the proposed interpretation and intended operation. It can permit “personalise a reversible coffee order”, require verification before “write a medical field”, or prohibit “disclose to an insurer”. After the decision, an action kernel separately checks whether the requested external effect is authorised.
This creates two independent choke points. The factual-use gate controls what may enter the decision as fact. The action gate controls what the system may do. An action can be permitted while its premise is not. For example, an assistant may have authority to edit a calendar, but it may not use an unverified memory of a medical appointment to cancel another commitment. Conversely, a fact may be authorised for display but not for external disclosure.
Retrieved item
“Oat milk is usually easiest for me.”
- Source: direct user statement
- Type: preference
- Age: 42 days
- Subject: Arun
Intervene on purpose and consequence
Reversible, low consequence
ALLOW PERSONALISATION
Health field, durable record
VERIFY, DO NOT PROMOTE
The remembered sentence is “Oat milk is usually easiest for Arun.” For a coffee order, the proposed operation is personalise: choose oat milk, keep the choice visible and let Arun change it. For a restaurant search, the operation is filter provisionally: prefer venues with a non-dairy option, but do not exclude every venue that serves dairy. For a hospital form, the proposed operation would be assert a health condition. That third operation is not licensed by the sentence’s type, even though the text is equally relevant in all three contexts.
This is the smallest useful example of factual authorisation. The record does not become more or less true as it moves between screens. What changes is the transformation the system wants to perform. Personalisation preserves the statement as a revisable preference. Filtering makes a low-stakes prediction from it. A medical entry changes its semantic status, durability and audience. The gate therefore returns PERSONALISE, HYPOTHESISE and VERIFY respectively. One memory supports three different modes without a contradiction.
Seven checks and six useful outcomes
The smallest useful gate evaluates seven dimensions. Provenance asks whether origin and derivation are known and tamper-evident. Subject checks that the claim concerns the person, organisation or object in the current decision. Purpose compares the proposed use with the collection purpose and allowed secondary uses. Authority identifies the lawful, contractual, policy or user-granted basis for processing and disclosure. Time checks validity, freshness, supersession and revocation. Conflict searches for stronger or independent contradicting evidence. Consequence determines how much evidence and review the operation requires.
Consent is one possible authority basis, not a magic field that legalises everything. A system may operate under contract, legal obligation, vital interest, public task, legitimate interest or another applicable basis, depending on jurisdiction and setting. Even valid consent can be purpose-specific, revocable and insufficient for certain downstream actions. The engineering rule is simpler: the record must name the applicable authority basis and its scope; a blank field does not default to “the user probably agreed”.
Consent is not the same as factual warrant
Two questions are easily confused. “May the system process this information?” concerns authority. “Does this information warrant the proposed claim?” concerns evidence. Consent can answer part of the first question but not the second. A user may consent to storing an address that they typed incorrectly. An organisation may have a legal duty to retain a report that contains disputed allegations. A sensor reading may be highly accurate yet collected for a purpose that does not permit its use in employee evaluation. Lawful possession does not manufacture truth, and strong evidence does not manufacture permission.
The reverse confusion is equally dangerous. Teams sometimes demand consent for every factual use even where another authority basis applies, then treat the presence of a checkbox as proof of responsible processing. That design turns a contextual decision into a generic token. A better record names the actor who granted or established authority, the subject it covers, the operations allowed, the purpose, the expiry or revocation mechanism, and any duties such as attribution, minimisation or human review. The gate evaluates that authority alongside evidence instead of substituting one for the other.
This separation also helps with contested facts. A person can withdraw permission for optional personalisation without erasing an organisation’s independent obligation to preserve an audit record. Equally, an organisation may retain the record while being prohibited from reusing it for marketing. The system needs distinct verbs for store, retrieve, quote, infer, decide, disclose and act. A single “consented” flag cannot express those relations.
The gate should not collapse its result into a single trust score. Scores encourage threshold laundering: enough weak signals can compensate for one decisive prohibition. A better return type is an operation. The practical set used here is:
| Outcome | What the system may do | What it must not imply |
|---|---|---|
| PERSONALISE | Use as a reversible preference within the same subject and purpose. | That the item is objectively true or suitable for a durable record. |
| QUOTE ATTRIBUTED | Present the original statement with speaker, time and context. | That the speaker’s assertion has been independently verified. |
| HYPOTHESISE | Use as a candidate explanation or search lead. | That the inference may silently drive an external effect. |
| VERIFY | Request confirmation or obtain an authoritative current source. | That retrieval itself satisfies the verification duty. |
| USE AS FACT | Use within the named purpose, operation, time and obligation set. | That the item is reusable for every future purpose. |
| DENY | Exclude from the decision and record the policy reason. | That deletion is always required; retention and use are separate questions. |
A compact formalism helps expose the logic. Let a proposed factual use be u, a memory item be m, the current decision context be c, and policy be π. The gate returns an allowed operation set rather than a truth probability:
The equation is valid only if the dimensions are represented independently and policy can impose non-compensable rules. If authority is revoked, excellent provenance cannot compensate. If subject binding fails, freshness cannot rescue the item. If the consequence is high, a direct assertion may still require an authoritative readback. Removing this assumption and averaging the dimensions into one score changes the mechanism: hard prohibitions become negotiable.
Suppose the gate assigns no universal “truth score”, but an engineer still wants a traceable toy calculation. The coffee request has low consequence, same subject, same purpose and no conflict. Six binary checks pass. Freshness is rated 0.8 because the preference is six weeks old. Source strength is 0.7 because it is a direct user assertion rather than an observed biological constraint. A naïve weighted average gives 0.94 and looks decisive. Now change only the operation to “record lactose intolerance”. The numeric inputs barely change, yet policy adds a hard rule: health assertions require an authoritative source or contemporaneous confirmation. The result becomes VERIFY, not 0.94. The example shows why arithmetic may rank candidates but must not replace typed policy.
Leena asks an assistant to remember her partner’s passport number for a surprise holiday booking. Later she cancels the trip and revokes travel-planning permission, but the encrypted memory remains for an audit retention period. The next week, a new travel task retrieves it. Does successful decryption imply permission? No. Retention, readability and factual use are different rights. Revocation must close the use path even when storage remains lawful and technically accessible.
The chart makes a falsifiable engineering prediction. Compared with permissive retrieval or a single trust threshold, a typed gate should sharply reduce unauthorised promotions, especially where subject, purpose or revocation fails. It will also increase verification and abstention. The proposal is weakened if a simpler policy achieves the same prevention with lower review burden, or if the typed fields cannot be captured reliably enough to drive decisions.
stateDiagram-v2 [*] --> Claim state "The hidden assumption inside<br/>“the system remembers”" as Claim state "A typed claim, not a decorated<br/>string" as Test state "Separate retrieval,<br/>interpretation, authorisation<br/>and effect" as Revision Claim --> Test: expose mechanism Test --> Decision: evidence survives Test --> Revision: rival survives Revision --> Claim: narrow or rebuild Decision --> [*]
Keep authority outside the model
The model may propose an interpretation. It must not be able to grant that interpretation authority by phrasing it confidently.
The record that prose usually hides
A language model is useful for extracting candidate claims, detecting possible conflicts and explaining policy decisions. It is a poor place to enforce hard authority because its output is probabilistic and prompt-sensitive. The authoritative record and policy decision therefore sit outside the model. The model receives only the permitted representation: perhaps an attributed quotation, a preference, a hypothesis, a verified fact with expiry, or nothing.
The following schema is deliberately small. It separates the original claim from derived summaries, names the subject and acquisition event, and gives policy something concrete to evaluate. A production version would add jurisdiction, data-controller roles, retention policy, signatures, policy version, source independence and field-level sensitivity.
type ClaimKind =
| "preference" | "assertion" | "observation"
| "inference" | "instruction" | "delegation";
type FactualMode =
| "personalise" | "quote_attributed" | "hypothesise"
| "verify" | "use_as_fact" | "deny";
interface MemoryRecord {
id: string;
subjectId: string | "unknown";
claimKind: ClaimKind;
originalClaim: string;
source: {
originId: string;
channel: "user" | "tool" | "sensor" | "model" | "import";
acquiredAt: string;
derivedFrom: string[];
integrityRef?: string;
};
validTime?: { from: string; until?: string };
collectionPurpose: string;
allowedPurposes: string[];
authority: {
basis: "consent" | "contract" | "law" | "policy" | "none";
grantId?: string;
revoked: boolean;
};
allowedModes: FactualMode[];
sensitivity: "ordinary" | "confidential" | "special";
}
interface UseDecision {
mode: FactualMode;
reasons: string[];
obligations: ("attribute" | "verify" | "minimise" | "readback")[];
policyVersion: string;
expiresAt?: string;
}The schema makes two important absences visible. There is no generic trusted: true, because trust is relational and operation-specific. There is no field in which the model writes “this is a fact”. The model can propose a claim kind and provide evidence. Policy determines permitted use.
The authority kernel and its receipts
The factual-use gate belongs in a deterministic authority kernel, not in the prompt. A typical request contains the actor, represented subject, purpose, proposed claim, proposed mode, decision consequence, current time and target action. The kernel resolves policy, fetches the memory record by identifier, checks revocation and conflict, and returns a signed or tamper-evident decision receipt. The model sees the result but cannot alter it.
The receipt matters because “the assistant remembered” is not an adequate audit explanation. A reviewer needs to know which source item was used, how it was interpreted, which policy version allowed it, which obligations were attached, and which effect followed. The decision receipt can be joined to an execution receipt and an independent readback. If the action later proves wrong, investigators can separate source failure, derivation failure, policy failure, model interpretation and tool execution.
Executable lab: factual authorisation gate
Change the evidence and decision context. The result is a bounded mode, not a truth score.
- Direct preference, matching subject and allowed low-consequence purpose.
- Do not infer an allergy or durable medical fact.
What the lab tests: whether hard policy failures dominate soft evidence strength, and whether consequence changes the permitted mode. Its assumptions are explicit: purpose and authority are independently resolvable; authoritative sources are distinguishable; and high-consequence use requires stronger evidence. A positive result means only that the encoded policy returns the expected operation for these synthetic cases. A negative result identifies a rule conflict or missing attribute. The lab cannot establish legal compliance, factual truth, source independence or production safety.
Optional depth: decision procedure and test invariants
The implementation evaluates prohibitions first. Subject mismatch, prohibited purpose, revoked authority, expiration or stronger contradiction returns DENY. Missing subject, authority, purpose or freshness returns VERIFY for material use. Inference and weak derived content may be used only as HYPOTHESIS. Direct preferences may personalise low-consequence reversible choices. A current authoritative observation may be used as fact, but high-consequence operations carry readback and minimisation obligations.
Useful invariants include: revocation never increases permission; raising consequence never expands the operation set; a derived summary cannot have stronger origin authority than its strongest independent source; subject mismatch always denies; and an inference cannot become an observation through repetition. These properties are more valuable than a benchmark average because they can be tested under every policy change.
A realistic configured-system example
A public-service assistant helps Noor complete a benefit-renewal application. It retrieves four items: Noor’s earlier statement that she moved house; a model summary saying the move was “permanent”; a scanned tenancy agreement that expired last month; and a current address returned by the authoritative resident register. The model proposes the new address as fact.
The gate groups the records by derivation. The summary does not count as independent support because it derives from Noor’s statement. The expired tenancy document is relevant historical evidence but not current proof. The resident-register response is current, authoritative for this purpose and bound to Noor’s verified identity. Policy returns USE AS FACT with three obligations: disclose only the fields required by the renewal, cite the register response in the decision receipt, and read back the submitted address before final release.
Now remove the register response. The assistant still has plausible evidence, but the purpose is consequential and the evidence is stale or self-asserted. The correct outcome becomes VERIFY. The user can confirm, upload current evidence or route the case for human review. The system remains useful because it can prefill an attributed candidate without silently certifying it.
| Memory item | Personalise | Quote | Hypothesise | Use as fact | Typical break condition |
|---|---|---|---|---|---|
| Direct preference | Usually | Yes, attributed | Sometimes | Only for narrow reversible use | Changed preference or subject ambiguity |
| Direct assertion | Sometimes | Yes, attributed | Yes | Policy and consequence dependent | Durable or high-impact field |
| Named observation | Sometimes | Yes | Yes | Within validity and source scope | Stale measurement or wrong instrument |
| Model inference | Rarely | As model output | Yes | No, without independent evidence | Inference laundering |
| Derived summary | Within source rights | Only with lineage | Yes | Never stronger than sources | Qualifier or origin loss |
| Active delegation | Not applicable | Yes | No | As authority, not world fact | Expiry, revocation or scope change |
Failure injection: poison the memory, not the prompt
Persistent memory creates an attack surface that ordinary prompt filtering does not close. An attacker can plant a vendor bank account, support number or exception rule in one session and wait for a later legitimate task to retrieve it. Recent research has demonstrated several forms of memory poisoning and highlighted derivation laundering, in which summarisation or tool echoes make an untrusted origin look stronger. These results are preliminary and system-specific, but they expose the correct target for testing: the write-retrieve-act chain.
A factual-use gate does not solve every poisoning attack. It helps when origin authority is bound at write time, derived records cannot outrank their sources, corroboration requires independent principals, and consequential uses require a current authoritative readback. It fails if the authority registry itself is compromised, if multiple attacker-controlled identities appear independent, or if policy permits weak sources for high-consequence use.
An attacker sends a support document containing a new bank account for supplier Northstar Components. A summariser records “Northstar payments now use account 5571”. Days later, an accounts assistant asks the agent to prepare a legitimate invoice payment. Retrieval works exactly as designed and the model finds no linguistic sign of fraud. A confidence threshold may even rise because a second internal note repeats the account.
The typed gate follows derivation rather than repetition. Both notes descend from the external document, whose origin has no authority to amend the vendor master. The proposed operation is a high-consequence payment, so policy requires a current account readback from the authorised vendor registry plus dual approval. The result is DENY CURRENT FACTUAL USE and VERIFY THROUGH AN INDEPENDENT PATH. The system may preserve the suspicious note as incident evidence, but it cannot promote it into payment truth.
Change one variable: the authorised vendor registry now returns account 5571 through an authenticated channel. The text has not become safer because it was repeated. A new independent source has satisfied the required operation. The gate may issue a short-lived decision receipt tied to this invoice, amount and beneficiary. It still does not grant the model a permanent rule that every future Northstar payment uses the same account.
Provenance does not prove truth. A perfectly traceable authoritative source can be wrong, compromised or outside its competence. The gate authorises use under declared assumptions; it does not remove the need for source governance, correction mechanisms, incident response and appeal.
sequenceDiagram participant Q as Question participant M as Mechanism participant E as Evidence participant D as Decision Q->>M: When memory becomes a claim M->>E: The hidden assumption inside “the system remembers” E-->>M: compare rival explanations E->>D: Authorise the factual use, not merely the read D-->>Q: revise scope or act
Authorise the factual use, not merely the read
Stop asking whether the assistant “has memory”. Ask which remembered claims are authorised to perform which operations.
The strongest alternative: better retrieval is enough
A reasonable critic may argue that the proposal adds machinery around a problem already handled by access control, provenance and retrieval quality. Improve source ranking, attach citations, restrict sensitive stores and ask for confirmation when confidence is low. Why invent a new gate?
That alternative is strong because many failures really are poor retrieval or missing access controls. The factual-use gate should not duplicate them. Its separate value appears when all of those controls succeed and the use is still wrong. The system may be authorised to read a record, retrieve the right record, quote it accurately and still lack authority to use it as a present fact for this subject, purpose or consequence. Access answers whether the actor may perform an operation on an object. Factual authorisation adds an epistemic operation: may this representation constrain the decision as fact?
The distinction becomes especially visible with derived content. A model can lawfully read a diary entry and generate a useful hypothesis about stress. That does not authorise it to place “anxiety disorder” in an employment decision. It may retrieve a previous delivery address and use it to suggest an option, but not silently certify residency. It may remember that a manager once waived a rule, but not treat the exception as a standing policy. Correct retrieval does not settle the authority of interpretation.
Scale evidence strength with consequence
The gate should not demand official proof for every ordinary preference. That would make personal systems brittle and paternalistic. Nor should it let a friendly conversational style smuggle weak memory into durable decisions. The practical design is a consequence-sensitive surface. Reversible personalisation tolerates direct, recent assertions. Material but recoverable decisions may require confirmation. High-impact, durable or third-party effects require current authoritative sources, independent checks or human adjudication.
You clone an assistant, its encrypted memory and all current model weights. Clone A continues serving you. Clone B is transferred to a research environment whose operators may inspect behaviour but may not act on your behalf. Both can retrieve the same address, preferences and past delegations. Do they possess the same facts? They possess the same representations. They do not possess the same authority. The experiment changes the actor and purpose while preserving memory and behaviour. It shows that factual authorisation is partly relational, not a property stored inside the sentence.
Where the proposal should not be applied
Not every remembered item needs a heavyweight gate. Private drafting with no external effect may rely on ordinary provenance labels and user review. Ephemeral session context that is neither retained nor used consequentially may not justify the same machinery. Purely mathematical facts or public reference data may require source and freshness controls but not personal consent. The gate is most valuable where personal, organisational or inferred memory crosses into a durable decision, disclosure or action.
It should also not be presented as a consciousness claim. Typed memory concerns system governance, not whether a machine remembers in the experiential sense. Nor should it be treated as proof that an authorised claim is correct. The system is deciding what it may rely upon, given evidence and policy, while preserving a route for correction.
For consequential agent tasks, operation-typed factual authorisation will reduce cross-purpose, cross-subject and derivation-laundered errors more than confidence thresholds with an acceptable increase in verification burden. Evidence that strengthens the proposal would include lower unauthorised-promotion rates under matched utility and adversarial memory writes. It would be weakened by a simpler control with equal prevention, or by policy fields so unreliable that the gate mostly produces ceremonial denials. A rival explanation is that provenance quality alone drives the gain. The smallest useful experiment is a synthetic task suite in which content remains constant while subject, purpose, revocation, derivation and consequence are independently varied.
Build the smallest useful version
A team does not need a universal ontology before it can improve. Start with one consequential workflow and five memory types: direct assertion, observation, inference, summary and delegation. Bind every record to a subject and origin. Preserve derivation. Name the current purpose and authority basis. Implement three hard denials: subject mismatch, revoked authority and prohibited purpose. Add two graduated outcomes: personalise for low-consequence preferences and verify for material claims without a current authoritative source. Log the decision and read back the effect.
Then inject failures. Swap the subject. Revoke the grant after write. Remove a qualifier through summarisation. Echo one malicious source through two tools. Advance the clock beyond validity. Increase the consequence without changing the memory. A satisfactory design should never expand permission after any of those interventions. Measure not only blocked errors but unnecessary questions, completion time and whether users can understand and correct the reason.
Do not connect retrieved memory directly to model reasoning as untyped fact. Insert a model-independent factual-use decision that binds each proposed use to provenance, subject, purpose, authority, time, conflict and consequence. Return a permitted epistemic operation, attach obligations and carry its receipt into the action and readback. Memory should make a system more helpful only to the extent that its authority remains inspectable, revocable and narrower than its ability to recall.
Glossary
- Authority basis
- The legal, contractual, policy or user-granted ground that permits a specific processing or disclosure.
- Decision receipt
- A tamper-evident record of inputs, policy version, outcome, reasons and obligations for an authorisation decision.
- Derivation laundering
- The apparent strengthening of an untrusted claim when summaries, echoes or repetitions hide its original source.
- Factual authorisation
- Permission to use a remembered representation in a specified epistemic mode for a particular decision.
- Operational fact
- A claim authorised to constrain a defined decision under stated evidence, time and policy conditions.
- Provenance
- Information about the entities, activities and agents involved in producing or transforming a record.
- Subject binding
- The explicit relation between a claim and the person, organisation, object or case it concerns.
- Typed memory
- A memory record whose claim kind, origin, authority, validity and allowed operations are represented separately.
References
- European Union. Regulation (EU) 2016/679, General Data Protection Regulation, 2016. See especially Articles 5 to 7 and 9 for purpose, accuracy, lawfulness, consent and special-category processing.
- Hu, Vincent C. et al. NIST SP 800-162: Guide to Attribute Based Access Control Definition and Considerations, updated 2019.
- Moreau, Luc and Missier, Paolo, editors. PROV-DM: The PROV Data Model. W3C Recommendation, 2013.
- Iannella, Renato and Villata, Serena. ODRL Information Model 2.2. W3C Recommendation, 2018.
- Lodderstedt, Torsten, Richer, Justin and Campbell, Brian. RFC 9396: OAuth 2.0 Rich Authorization Requests, 2023.
- Saltzer, Jerome H. and Schroeder, Michael D. The Protection of Information in Computer Systems. Proceedings of the IEEE, 1975.
- Nissenbaum, Helen. Privacy as Contextual Integrity. Washington Law Review, 2004.
- Byun, Ji-Won, Bertino, Elisa and Li, Ninghui. Purpose Based Access Control of Complex Data for Privacy Protection. SACMAT, 2005.
- NIST. Artificial Intelligence Risk Management Framework 1.0, 2023.
- Autio, Chloe et al. NIST AI 600-1: Artificial Intelligence Risk Management Framework, Generative Artificial Intelligence Profile, 2024.
- NIST. NIST Privacy Framework 1.0, 2020.
- Data Privacy Vocabulary Community Group. Data Privacy Vocabulary, current canonical specification.
- Park, Joon Sung et al. Generative Agents: Interactive Simulacra of Human Behavior. UIST, 2023.
- Packer, Charles et al. MemGPT: Towards LLMs as Operating Systems, 2023.
- Huang, Yangsibo et al. A Systematic Study of Memory Poisoning Attacks in LLM-based Agents, preprint, 2026. Preliminary evidence; not treated as an established production rate.