The sentence that outlived its authority

Why does the twelve-crate error feel surprising? Most software vocabulary encourages a simple picture. Data enters a system, the system retains it, and later the system retrieves it. If the retained representation is accurate, retrieval is relevant and reasoning is sound, the resulting answer should improve. That picture works for drafting a reply or remembering a preference. It fails when an action changes a shared world.

The hidden assumption is that persistence is a single property. In practice, every retained item answers a different question. A model checkpoint asks, “Which learned transformation should run?” A workflow checkpoint asks, “Where should this computation resume?” An episode asks, “What did this agent encounter?” A knowledge record asks, “Which proposition or rule is available for reference?” World state asks, “What does the authorised operational system currently assert?” An evidence ledger asks, “What was observed, authorised, attempted and verified?”

These questions can point to the same payload. The sentence “twelve crates are available” could appear in all five places. What changes is not the wording. What changes is the item’s owner, temporal meaning, update discipline and permitted use. Authority is a relation between a record and a decision, not a substance stored inside the record.

Six thresholds hidden inside one sentence

A retained sentence can pass one test and fail the next. It may be accurately remembered, yet no longer true. It may be true, yet not current at the decision cutoff. It may be current, yet come from a source that does not own the subject. It may be authoritative, yet unavailable for this purpose because consent, policy or role does not permit its use. It may be authorised context, yet still be insufficient to support a particular action. It may support an action, yet leave no evidence that the action occurred.

These are not philosophical refinements. Each threshold calls for a different control. Accuracy needs source comparison. Currency needs time and update awareness. Authority needs ownership and conflict semantics. Entitlement needs identity and purpose. Actionability needs a typed contract and invariant. Evidence needs capture, linkage and readback. A single confidence score cannot substitute for this structure because high confidence about the wrong question remains wrong.

Consider a verified shipping policy that says orders above ten units require approval. The document can be authentic, current and authoritative. It still cannot tell us whether approval was actually granted for Order 81, whether twelve units remain available or whether the reservation succeeded. Conversely, a live inventory record can establish availability but not policy meaning. Reliable action depends on composing several authorised records without allowing any one of them to impersonate the others.

Current agent frameworks already expose fragments of this distinction. LangGraph, for example, describes checkpointers as thread-scoped graph-state snapshots and stores as cross-thread application data.[1][2] PyTorch checkpoints may contain model parameters, optimiser state, epoch and loss so training or inference can resume.[3] Neither mechanism, by itself, establishes the current stock, account status or policy entitlement outside the computation.

Cognitive architectures also distinguish working, episodic, semantic and procedural memory. CoALA applies that vocabulary to language agents, while noting that episodes store earlier decision cycles and semantic memory stores knowledge about the world.[4] A later survey argues that agent-memory terminology has become fragmented enough that ordinary long-term and short-term labels are no longer sufficient.[5] These taxonomies are useful, but they still leave an operational question unanswered: which stored item may authorise which action?

flowchart LR
  A["Twelve crates"] --> B["The sentence that outlived its<br/>authority"]
  B --> C["Five reservoirs, five questions"]
  C --> D["The gate between proposal and<br/>effect"]
  D -. "re-test" .-> A
  classDef first fill:#0a1424,stroke:#7B4CD8,stroke-width:2px,color:#e6f3ff
  classDef step fill:#0a1424,stroke:#3f7da0,stroke-width:1px,color:#e6f3ff
  class A first
  class B,C,D step

Five reservoirs, five questions

Calling everything memory hides the property that matters most: what kind of mistake becomes possible when the record is wrong, stale or misapplied? A poor episode may personalise a response badly. A stale world-state read may allocate stock twice. An incomplete evidence record may make an incident impossible to reconstruct. The payload can be similar while the failure geometry differs.

Checkpoints preserve a computation

A model checkpoint preserves parameters and often training state. A runtime checkpoint preserves a workflow’s local graph or continuation state. Their authority is endogenous: they can determine which computation resumes and with which local variables. They do not automatically inherit authority over the environment that changed while the computation slept.

This distinction explains why “time travel” features require care. Restoring an earlier graph state can be valuable for debugging or branching, yet any external effect already committed may remain. A checkpoint is therefore closer to a saved position in a game than to the current state of the shared game server. It restores a player’s local trajectory. It does not erase other players’ moves.

Episodes preserve encounters

An episode records that the agent observed, inferred, attempted or experienced something at a particular time. It may include context, salience, confidence and a later reflection. Episodic retrieval can improve continuity and planning, as demonstrated by architectures that store observations and retrieve them for later behaviour.[15] But an episode is indexed by its relation to an agent’s past, not by a guarantee that the world still matches it.

An episode should therefore use report-like grammar: “At 09:00, source S returned quantity 12”, not ontological grammar: “Quantity is 12”. That small wording change exposes time and source. It also creates a natural validation step before action.

Knowledge preserves claims and rules

Knowledge stores hold propositions intended to travel across episodes: product descriptions, procedures, policies, definitions, relationships and learned summaries. Some knowledge is descriptive. Some is normative. Some is authoritative only for a specific jurisdiction, product, customer or period. A document can be authentic and still be inapplicable.

The important question is not whether the vector store retrieved the right paragraph. It is whether the paragraph’s version, effective period, subject and purpose match the decision. A policy published last year may remain useful for explanation while being invalid for today’s approval. Semantic relevance is not temporal or legal entitlement.

World state preserves an operational assertion

World state is the state against which an operation is authorised and committed. It may be held in a transactional database, a device controller, an order-management system, a scheduling service or a simulation engine. It is “world” state only relative to a declared operational boundary. In Kubernetes, for example, the object specification expresses desired state while status reports current state, and controllers work to reconcile the two.[6]

World state requires more than freshness. It needs an owner, update semantics and a conflict rule. PostgreSQL transactions provide all-or-nothing effects and control when concurrent changes become visible.[7] Multiversion concurrency control prevents a session from seeing inconsistent intermediate updates, while stricter isolation or explicit locks address particular conflicts.[8] These mechanisms do not make every value true, but they define how competing writes become an accepted operational state.

Evidence ledgers preserve the execution story

An evidence ledger records what input was used, who or what held authority, which policy decision was returned, what action was attempted, what effect was reported and what readback confirmed. Temporal describes event history as a durable append-only record that supports recovery and debugging.[9] W3C PROV distinguishes entities, activities and agents so derivation and responsibility can be represented.[10] NIST audit guidance calls for event type, time, location, source, outcome and associated identities, and recommends preserving original content and time order.[11]

A ledger is not automatically trustworthy. Logs can be missing, mutable, mis-timestamped or detached from identity. OpenTelemetry standardises a log data model, but a common envelope does not prove that an event occurred as claimed.[12] Evidence authority depends on capture point, integrity, provenance and correlation with the effecting system.

One record needs two clocks

World-state records often need at least two times. Valid time says when the fact applied in the modelled world. Recorded time says when the system learned or stored it. Snodgrass and Ahn’s temporal-database work made this distinction explicit decades ago.[13] It matters whenever observations arrive late or corrections apply retrospectively.

Suppose a depot scan performed at 09:07 is uploaded at 09:12. A system that records only upload time may claim twelve crates at 09:11 even though seven were valid then. A system that overwrites the old value loses the fact that its earlier decision was made under incomplete information. Two clocks let us ask both: “What was true at the decision cutoff?” and “What could the system have known when it decided?”

Here use is the proposed use, such as resume, personalise, explain, plan, act or prove. The time t is the decision cutoff. The equation assumes each condition can be evaluated deterministically. If validity or version cannot be established, the result is not “probably admissible”. It is a guarded result that requires a live read, human review or abstention.

The conjunction is intentionally unforgiving. A highly trustworthy source with the wrong subject should fail. A current record used for an unauthorised purpose should fail. A perfectly shaped JSON object with missing provenance should fail for proof. JSON Schema can validate structure and constraints, but it cannot establish that the content is true, current or authorised.[14]

The gate between proposal and effect

Once persistence types are explicit, the architecture changes. The model is no longer asked to decide which text counts as reality. It may interpret intent, retrieve context, compare options and propose a typed action. A deterministic authority kernel then checks identity, permission, state version, temporal validity and transaction conditions before any effect occurs.

This division does not require distrust of language models in every role. It places stochastic reasoning where alternatives and ambiguity are real, while placing enforceable conditions where the organisation has already decided what must hold. The model may propose the future; it must not redefine the present at commit time.

A minimum action path

A consequential agent needs six separations. Intent states what outcome the user seeks. Identity states who is asking and on whose behalf. Permitted context limits what evidence may enter. The model proposal names a typed action and its rationale. Authority decides whether that action is allowed against current state. The effecting tool commits the action and returns a receipt. Readback then verifies the resulting world state.

The resulting path is deliberately asymmetric. Rich context may flow into planning, but only narrowly typed fields should flow into the action contract. A procurement proposal might contain pages of reasoning. The commit contract may contain only supplier ID, item ID, quantity, price ceiling, currency, state version, approval ID and idempotency key.

Why retrieval confidence cannot be the gate

Suppose the memory system assigns the twelve-crate episode a similarity of 0.97, a source-trust score of 0.94 and a recency score of 0.88. Combining them may produce an impressive number, but the number answers a ranking question: which item should the model inspect? It does not answer whether another allocation has committed, whether the item is reserved, whether the caller may place an order or whether the action is reversible.

A confidence threshold also encourages unsafe substitution. When the live state service is unavailable, the system may fall back to the “next best” memory item. That is reasonable for drafting an explanation. It is dangerous for allocating scarce stock. The correct fallback for an authority dependency is usually a narrower action, an expiring hold, an abstention or a human route. It is not a more confident guess.

This yields a practical placement rule. Use probabilistic retrieval to decide what deserves attention. Use deterministic policy to decide what may enter an action contract. Use the effecting system to decide whether the transition can commit. Use readback to decide what actually changed. Ranking, permission, commitment and verification are four different computations, even when one user request triggers all four.

The lab tests admissibility, not truth. A positive result means the record type and supplied controls are sufficient for the chosen use under the encoded policy. It does not prove that the payload is factually correct. A negative result means the item must be reclassified, validated against an authoritative source, narrowed to a less consequential use or rejected. The smallest useful implementation is the matrix plus a versioned world-state read and a linked effect receipt.

/** @typedef {'checkpoint'|'episode'|'knowledge'|'world_state'|'evidence'} Kind */
/** @typedef {'resume'|'personalise'|'explain'|'plan'|'act'|'prove'} Use */

const primaryUses = {
  checkpoint: new Set(['resume']),
  episode: new Set(['personalise']),
  knowledge: new Set(['explain', 'plan']),
  world_state: new Set(['plan', 'act']),
  evidence: new Set(['prove'])
};

function evaluateRecord(record) {
  const reasons = [];
  const guards = [];
  const primary = primaryUses[record.kind].has(record.use);

  if (record.permission === 'denied') reasons.push('Purpose is denied.');
  if (record.use === 'act' && record.kind !== 'world_state') {
    reasons.push('Only world state can directly authorise an external action.');
  }
  if (record.use === 'prove' && record.kind !== 'evidence') {
    reasons.push('Proof requires a linked evidence record.');
  }
  if (record.kind === 'world_state' && ['plan', 'act'].includes(record.use)) {
    if (record.authority !== 'authoritative') reasons.push('Source is not authoritative.');
    if (record.validity !== 'current') reasons.push('Validity at the cutoff is not established.');
    if (record.version !== 'current') reasons.push('A current, conflict-checkable version is required.');
    if (record.use === 'act' && record.commitControl !== 'bound') guards.push('Bind the commit to a version or invariant.');
    if (record.use === 'act' && record.effectControl !== 'verified') guards.push('Use idempotency and verified readback.');
  }
  if (record.kind === 'evidence' && record.use === 'prove' && record.provenance !== 'complete') {
    reasons.push('Proof requires complete linked provenance.');
  }

  if (reasons.length) return {status: 'block', primary, reasons, guards};
  if (!primary || record.permission === 'conditional' || guards.length) {
    return {status: 'guard', primary, reasons: ['Additional controls are required.'], guards};
  }
  return {status: 'permit', primary, reasons: ['Record is admissible for the selected use.'], guards};
}

The evaluator makes the hidden rule explicit: a record cannot promote itself into a more authoritative role merely because the model finds it convincing.

stateDiagram-v2
  [*] --> Claim
  state "Six thresholds hidden inside<br/>one sentence" as Claim
  state "Perfect replay, wrong world" as Test
  state "What is sourced, and what is<br/>proposed here" as Revision
  Claim --> Test: expose mechanism
  Test --> Decision: evidence survives
  Test --> Revision: rival survives
  Revision --> Claim: narrow or rebuild
  Decision --> [*]

Recovery reveals the category error

Systems often discover state confusion only after interruption. A process crashes, a human changes a record, a tool times out or a workflow is reset. The team asks the agent to continue “where it left off”. That phrase sounds local, but recovery crosses several histories: intent, authority, computation, external effects and evidence.

Keep proposal context outside action authority

Stop asking whether an agent “has memory” as though retention were one capability. Ask a more operational sequence: What kind of record is this? Who owns the subject? When was it valid? When was it recorded? Which version is current? For which purpose may it be used? Which action can it support? What independent receipt will show the effect?

This decision changes architecture reviews. A diagram labelled “memory” is no longer acceptable. Teams should produce a typed state inventory, an authority matrix and a recovery path for “effect unknown”. It changes evaluation too. Test not only whether the agent remembers, but whether it refuses to promote recollection into fact, fact into permission or a response into proof.

Begin the review at each consequential effect rather than at the vector database. Name the system that owns the affected subject, the version or invariant that must still hold, the permission needed, the transaction boundary, the receipt emitted and the reconciliation path after a timeout. Then trace backwards to the proposal inputs. This reverses a common design habit. Teams often start with what the model can retrieve and later bolt on safeguards. The safer order starts with what an action must prove and admits context only for the role it can legitimately play. It also clarifies where cost belongs. Extra live reads are justified near irreversible commitments, not on every conversational turn. Episodes may remain rich and approximate, knowledge may remain searchable, and checkpoints may remain frequent, provided none can bypass the narrow authority gate.

The twelve-crate agent did not need a better recollection. It needed to know what recollection is for. World state is not the memory that happens to be freshest. It is the state whose ownership and transition rules make an action valid.