Context is a changing set of claims
An agent may receive user requests, system instructions, retrieved documents, observations, memories, workflow state and tool output. These have different owners, authority levels and lifetimes. A retrieved sentence is data; it must not silently become an instruction. A prior task decision is not automatically valid for a new principal, purpose or environment.
This is the primary L4 Governed Context & Knowledge design. Its two explicit interfaces are L6 Security, Identity & Governance for admission and disclosure rules, and L7 Evaluation & Observability for traceable context quality and effect evidence.
Admit a context record, not an untyped text blob
Each admitted item needs at least a source identity and stable reference, acquisition time, source version or digest, sensitivity/classification, permitted purpose, scope of applicability, confidence or epistemic status, expiry/invalidation rule and a responsible data owner. Capture relationships between original evidence, derived summaries and decisions without replacing the original record.
- Discover: select candidate evidence for the exact task and principal, not every reachable file.
- Classify: evaluate sensitivity, ownership, instructions-versus-data and allowed destination.
- Verify: check provenance, integrity, freshness, contradiction and scope before inclusion.
- Admit: issue a task-scoped view with references, redactions and expiry conditions.
- Use and observe: trace which admitted claims supported consequential conclusions.
- Invalidate: revoke or refresh context when policy, document version, purpose or access changes.
Separate short-lived working context from durable memory
Working context is assembled for a run and may disappear after completion. Durable memory is a retained assertion whose reuse creates future rights and risks. Promotion from one to the other should therefore require explicit admission criteria, provenance and a retention period. A model-authored summary is useful for retrieval but is not an immutable audit record.
Retrieval rank is not a statement of truth. Similarity measures semantic proximity; they do not establish authorship, legal permission, freshness or source authenticity. When two credible sources conflict, record both with timestamps and ask whether the disagreement changes the action decision. Do not discard the weaker-looking claim merely because it would make synthesis easier.
One case: a stale incident runbook
An incident-response assistant retrieves an old procedure that names a retired on-call owner. A newer directory record identifies the current owner, while an imported document contains an instruction to disable logging. The L4 gate should reject that embedded instruction as untrusted content, mark the older contact detail stale, and return a task-scoped answer citing the current authoritative owner. If no authoritative owner is confirmed, the safe result is an unresolved routing question—not a fabricated contact.
Failure-mode tests: revoked permissions; poisoned retrieval excerpts; expired memory; conflicting source versions; missing attribution; personal data in shared output; and long-context truncation of a disconfirming fact. Track citation correctness, denied disclosures, stale-context use, invalidation lag and downstream corrected decisions rather than “retrieval relevance” alone.
Reference standards and design boundary
NIST AI RMF Map calls for documenting the operational context, assumptions and limits; Measure discusses choosing relevant methods and metrics. They do not specify the record schema or admission pipeline described here. Microsoft's Durable Functions persistence guidance shows why storing large opaque payloads in execution history creates scaling and retention concerns, but does not establish AI memory trustworthiness.
Architecture decision: keep source evidence authoritative only within its declared scope, make context admission a revocable state transition, and retain claim-level provenance across summarization and reuse. A larger model window can help reasoning; it cannot replace purpose limitation or source governance.
Open questions: how will inherited classifications survive derived summaries; who can change memory retention; how quickly can a revocation propagate to caches; and which claims need fresh verification immediately before an effect?
Next in this series: Skills Replace Prompts and Memory Admission: What an Agent Is Allowed to Remember.
Privacy Notice: With your consent, this website uses Google Analytics to understand aggregate visits and content usage. Analytics is optional and is not used for advertising or cross-site profiling. Some content and images may be generated or modified with the assistance of AI; every AI-assisted item is reviewed and manually edited by a human before publication. Full Privacy Policy ·