A memory write needs purpose, provenance, and an explicit trust boundary

Tool responses, retrieved documents, and external messages are data about a task or environment. Instructions embedded in them do not automatically become user-authorized behavior simply because the model reads or summarizes them. A memory record should retain source type and origin so a later retrieval can preserve that distinction. Prompt-injection benchmarks such as AgentDojo empirically study this boundary in tool-using agents; their measured attacks and defenses are scoped evidence rather than a guarantee that one textual warning solves every case.

Define record classes appropriate to the application, such as an observed result, an explicit user preference, a derived procedure, or a pending action. Each has different evidence and scope requirements. A document's assertion can be stored as an assertion from that source without becoming an established fact. A useful schema keeps quotation or normalized claim, source identity, observation time, applicable task, derivation, and validation status distinguishable. Avoid flattening them into a single authoritative sentence whose origin is lost when another agent later retrieves it.

After eligibility checks, prioritize useful records under a storage or context budget. Retain a reference to a larger source when copying its entire text would crowd out necessary state. Similarity-based duplicate detection needs care: two reports can be redundant copies, or distinct observations about the same object at different times. Stable logical event IDs handle exact retries, while semantic consolidation needs an explicit merge policy. Do not collapse conflicting observations into a false consensus merely because their embeddings are near each other.

When a write updates an aggregate or source index, apply the required state changes atomically within a supported transaction or version-precondition scope. A retry after a lost acknowledgment should not create another logical observation. If persistence and publication cross systems, use a documented protocol such as an outbox with idempotent consumers rather than assuming the local commit made all external effects exactly once. Preserve correction and revocation lineage so derived claims can be reconsidered. Deleting one raw row does not automatically invalidate every summary or cached retrieval that used it.

Inject a duplicate result, a contradictory correction, an irrelevant but highly similar document, and a source containing an instruction outside the task's authority. Inspect the stored records and then run a later retrieval task to see whether the trust boundary survives persistence. Measure false promotion, missed useful observations, duplicate writes, correction propagation, and token cost. A system can reject the immediate instruction yet still store it as an unqualified rule that causes a later failure. The test must follow the full write-to-retrieval path rather than only the initial response.

The probability lab illustrates an independently selected count, not a write-policy validator. Reset, set both p=0.25 and n=20, predict mean five and variance 3.75, then Play or Step. Reset and set both p=0.5 and n=20 for mean ten and variance five. Exact binomial bars assume equal-probability independent trials; playback highlights outcomes rather than sampling. The model has no sources, instructions, provenance, transactions, or trust judgment. Actual write eligibility comes from the explicit policy and evidence, not from treating a random retention probability as validation.