Step 1 of 4
Make writes source-aware
Where a memory came from determines what it may become.
Instrument the memory write path with source awareness. Every write must carry the provenance of the content it derived from: USER-STATED (the user directly told the agent), OBSERVED (the agent verified via its own tool execution - a test passed, a file exists), UNTRUSTED-DERIVED (extracted from web pages, third-party docs, tool results of external origin), or INFERRED (the model's own reasoning). Policy by source: user-stated and observed may write to the normal store; untrusted-derived and low-confidence inferred route to quarantine (next step); nothing writes to a 'high-trust' tier except user-stated or multiply-observed. Refactor the memory tool so the source tag is required, not optional, and reject writes that cannot name their source.
Expected after this step
A source-required write path enforcing policy by provenance.
Should not happen
- ✕Persisting anything the agent 'learned' without asking where it came from
- ✕Memories with no provenance, so a poisoned fact is indistinguishable from a real one
- ✕Untrusted-sourced claims recalled with full authority
- ✕Never re-checking stored facts, so poison persists indefinitely
Verify before continuing
Do not move on until every check is true. The complete button stays locked until then.
Do not continue if…
- !Persisting anything the agent 'learned' without asking where it came from
- !Memories with no provenance, so a poisoned fact is indistinguishable from a real one
- !Untrusted-sourced claims recalled with full authority
- !Never re-checking stored facts, so poison persists indefinitely
If the AI messes this up
Use this when the AI fakes progress or breaks the feature. It forces a real fix.
Writes arrive without a credible source. The model is guessing sources to satisfy the field - tighten instructions and validation: 'observed' requires citing the tool result that proves it, or it is demoted to inferred.