Stored Is Not Supported: Typed Provenance and Assertion Guardrails for Persistent AI Agents
cs.CR
Submitted: 2026-09-02
Updated: 2026-09-02
Comments: 17 pages, 2 figures, 1 table. Companion paper to arXiv:2608.11632. Code: https://github.com/openkedge/pci/tree/main/src/epistemic_bounds
License: http://creativecommons.org/licenses/by/4.0/
The gist: Persistent AI agents construct autobiographical state through reflection, retrieval, and consolidation.
Terminology
Abstract
Persistent AI agents construct autobiographical state through reflection, retrieval, and consolidation. Persistence changes availability, not epistemic standing: stored or retrieved material is not thereby supported. Untrusted inputs, prompt injections, and model inferences can therefore enter persistent state and later be presented as agent history or user commitments. We specify typed provenance and assertion guardrails for autobiographical assertion boundedness, a system-relative release property requiring governed statements about the agent, user, or named relationships to satisfy accepted-evidence, temporal-validity, and disclosure policies. A typed provenance graph separates origin, dependency lineage, epistemic role, validity, and disclosure scope. A resolver evaluates authorized state projections and returns one evidential status, orthogonal conflict, staleness, and withholding flags, and a protected decision witness. A generate-verify-revise mediator then checks candidate semantic units before release and renders policy-authorized status responses. Under explicit assumptions about extraction, predicate correctness, resolution soundness, view declassification, and channel mediation, we prove a conditional assertion-boundedness contract. In an executable suite of 24 hand-authored conformance cases, typed mediation passed none of 19 unsafe opportunities unqualified while preserving all five supported controls. The flat/prior and source-tag comparison rules released 19/19 and 18/19 unsafe candidates, respectively. These results validate the encoded resolver and mediator obligations; they do not constitute an end-to-end evaluation of language models or retrieval systems.
Sources
- MemGPT: Towards LLMs as Operating Systems
- Mem0: Building Production-Ready AI Agents with Scalable Long-Term Memory
- Beyond Memory: A Transactional Continuity Kernel for Long-Lived AI Agents
- MemTX: Transactional Belief Commit for Stateful Agent Memory
- Hidden in Memory: Sleeper Memory Poisoning in LLM Agents
- Mitigating Provenance-Role Collapse in Long-Term Agents via Typed Memory Representation
- Eywa: Provenance-Grounded Long-Term Memory for AI Agents
- MemLineage: Lineage-Guided Enforcement for LLM Agent Memory
- ConsistencyGate: Preventing Memory Contamination in LLM Agents via Self-Consistency Admission Control
Related papers
- SoK: AI-Augmented Binary Reversing
- Relaxed Sender Anonymity for CBDC Interbank Settlement: A Zero-Knowledge Approach on Permissioned EVM
- Calibration-Family Overfit: Why Trusted Sabotage Monitors Don't Transfer Across Lineages
- Estimating the Social Cost of Corporate Data Breaches
- Efficient Fuzzy PSI under One-Sided Assumptions
- Sealing the Audit-Runtime Gap for LLM Skills