Stored Is Not Supported: Typed Provenance and Assertion Guardrails for Persistent AI Agents

Stored Is Not Supported: Typed Provenance and Assertion Guardrails for Persistent AI Agents

arXiv:2609.02127v1 [cs.CR] 2 Sep 2026

Jun He OpenKedge.io

Deying Yu OpenKedge.io

Abstract

it may assert. Benchmarks such as LoCoMo evaluate factual retrieval over extended conversational horizons [5]; retrieval alone cannot confer epistemic entitlement. Storing or retrieving an unverified string or model inference does not authorize its presentation as an authentic part of the agent’s autobiographical history. Consider an agent that ingests an untrusted document containing an embedded indirect instruction asserting that the user prefers public data disclosure. During background memory consolidation, a language model may distill this unverified instruction into a persistent user profile. In a subsequent session, the agent retrieves the isolated summary and asserts with first-person authority: “You asked me to share this information publicly.” Through recurrent retrieval and re-summarization loops, such ungrounded claims can selfcorroborate, while stronger successor models may embellish them with plausible parametric details. Prompt-injection evaluations show that untrusted inputs can steer agent reasoning [6]; in a persistent architecture, a resulting unsupported claim can survive the originating context and influence later agent-specific responses. Common mitigations—such as tracking source URLs, scoring model confidence, or prompting models for selfreflection—do not jointly enforce the policy dimensions considered here. A cryptographically authenticated source may supply inaccurate information; multiple retrieved records may trace back to a single upstream root, manufacturing an illusion of consensus; historically valid preferences can expire; and legitimately supported facts may be restricted from specific recipients. Crucially, procedural entitlement requires decoupling orthogonal operational dimensions: state admission (reachability from an authoritative head), evidential support (conformance to explicit dependency and derivation policies), agent stance (recorded belief versus attributed report), temporal validity (active versus expired), and disclosure authorization (recipient and purpose access control). None of these checks decides metaphysical truth; rather, they enforce auditable procedural bounds over what an agent is permitted to claim.

Persistent AI agents construct autobiographical state through reflection, retrieval, and consolidation. Persistence changes availability, not epistemic standing: stored or retrieved material is not thereby supported. Untrusted inputs, prompt injections, and model inferences can therefore enter persistent state and later be presented as agent history or user commitments. We specify typed provenance and assertion guardrails for autobiographical assertion boundedness, a system-relative release property requiring governed statements about the agent, user, or named relationships to satisfy accepted-evidence, temporal-validity, and disclosure policies. A typed provenance graph separates origin, dependency lineage, epistemic role, validity, and disclosure scope. A resolver evaluates authorized state projections and returns one evidential status, orthogonal conflict, staleness, and withholding flags, and a protected decision witness. A generate–verify–revise mediator then checks candidate semantic units before release and renders policy-authorized status responses. Under explicit assumptions about extraction, predicate correctness, resolution soundness, view declassification, and channel mediation, we prove a conditional assertion-boundedness contract. In an executable suite of 24 hand-authored conformance cases, typed mediation passed none of 19 unsafe opportunities unqualified while preserving all five supported controls. The flat/prior and source-tag comparison rules released 19/19 and 18/19 unsafe candidates, respectively. These results validate the encoded resolver and mediator obligations; they do not constitute an end-to-end evaluation of language models or retrieval systems.

1

Introduction

Autonomous AI agents increasingly maintain long-term state across extended interactions, employing hierarchical memory architectures that combine periodic reflection, semantic retrieval, and background consolidation [1–4]. Persistence expands what an agent can retrieve without establishing what 1

We address the central question:

motion that separate origin, dependency lineage, epistemic role, validity time, and disclosure scope (Section 2).

Can a persistent agent distinguish what it stores or its underlying model generally knows from what this specific agent has evidence, authority, and valid scope to claim?

2. Procedural resolution and forward correction. We design a typed resolver that evaluates authorized projections to return a single evidential status alongside orthogonal conflict, staleness, and withholding flags, generating a minimized, auditable decision witness and supporting dependency-aware invalidation (Section 3).

We formalize autobiographical assertion boundedness, a system-level release property governing outward statements concerning the agent, its user, or named relationships. Rather than attempting the intractable task of pruning a model’s latent parametric knowledge, our architecture treats storage and support as separate judgments by regulating transitions between explicit epistemic roles. Model priors, raw retrieved inputs, admitted evidence, derived interpretations, and recorded beliefs remain distinct persisted objects. Outward autobiographical assertions are mediated through an explicit release gate: unqualified content assertions must bind to admitted, policy-supported, current, and disclosure-authorized claims at an exact state head, whereas resolution-status responses must safely render internal resolver outcomes without leaking protected metadata. Separating storage from support requires more than a wellformed memory store: an opaque model can hallucinate biographical claims even when the store is flawless. We therefore establish three distinct enforcement surfaces:

3. Assertion mediation pipeline. We formulate a generate– verify–revise release gate and prove a conditional contract result for content assertions and recipient-safe status renderings under emission-head verification (Section 4). 4. Conformance validation and evaluation design. We provide an executable conformance suite covering 24 structured cases across six threat tracks, together with metrics and a separate protocol for future end-to-end evaluation (Section 5). Scope and boundaries. Our guarantees apply to declared autobiographical claims on mediated output channels over an intact accepted head. The executable artifact tests structured resolver and mediator behavior; it does not implement natural-language semantic extraction, generalized witness access control, generalized view-equivalence checks, full provenance-graph traversal, canonical assertion-artifact hashing, or target-origin admission checks. The mechanism also does not implement lower-level concurrency or crash recovery, certify external truth, audit unmediated out-of-band channels, or make claims regarding machine consciousness or subjective identity.

• State admission: Governs which claim-bearing objects become authoritative in the agent’s state store; • Authorized projection: Filters accepted state into taskand recipient-specific views prior to model context assembly; • Assertion mediation: Intercepts candidate responses at governed output channels to verify content support and disclosure safety before release. Together, these surfaces prevent persistence from silently converting availability into assertion authority.

2

We model the epistemic state of an autonomous agent over an abstract, authenticated state-transition interface. The results below are conditional on four environment assumptions:

Accepted-state boundary. Transactional state mechanisms govern which versioned objects become reachable at an authoritative head [7, 8]. This paper takes that accepted head as an authenticated input and addresses a different question: which reachable claims support a particular outward statement for a particular recipient and time. Atomic storage therefore remains an assumption at the lower boundary, not a contribution or evaluation target of this work. Reachability supplies candidates for resolution; it does not establish support by itself. Contributions.

Epistemic State Model and Threat Boundary

• (E1) Authoritative state ordering: A monotonically versioned branch head h identifies a finite reachable set of accepted, immutable epistemic objects, separating them from uncommitted, speculative, or rejected candidates. • (E2) Versioned dependency closure: Every evidence, claim, and derivation identifier within the accepted state resolves deterministically to an immutable content version or an explicit, authenticated unavailable marker.

This paper makes four contributions:

1. Typed autobiographical claim model. We formulate a typed provenance graph over evidence and claim vertices, with policy-relative root recognition and role pro-

• (E3) Immutable policy binding: Epistemic admission, projection, and release policies κ are versioned, authenticated, and bound to execution contexts. 2

• (E4) Closed channel mediation: Every governed outbound communication channel routes candidate agent emissions through the assertion mediator without unmonitored bypass paths.

represent the opaque space of statistical correlations, pre-trained weights, and prompt-context associations accessible to model m. The release mechanism does not assume that this space is available as an enumerable, authenticated set of claims.

Append-only logs, Merkle DAGs, and transactional stores can realize E1–E2 (e.g., [7, 8]). Our theoretical formulation treats the accepted head h as an abstract authenticated input. The model therefore focuses on epistemic classification, dependency topology, and warranted assertibility. 2.1

Let Φagent (h) = {ϕ(v) | v ∈ C agent (h)} be the propositions carried by accepted claim objects. Rather than attemptmodel ing to prune or retrain Im , the release contract uses the following non-entitlement principle: CanGeneratem (ϕ) ̸⇒ ϕ ∈ Φagent (h).

Covered Autobiographical Language

The model’s ability to generate a proposition does not give that proposition standing in the agent’s historical state. Consequently, upgrading or replacing the model substrate (m1 → m2 ) under a fixed state head h may alter linguistic fluency, general reasoning, or heuristic planning, but leaves the accepted autobiographical claim set C agent (h) invariant.

Let Lbio ⊂ L denote the covered formal sublanguage of structured autobiographical propositions. A proposition ϕ ∈ Lbio is a typed tuple specifying a subject, predicate, argument terms, temporal interval, and epistemic modality, where: 1. The subject designates the agent itself, its authenticated principal (user), or a named relational entity within their shared operational environment; and

2.3

2. The predicate characterizes an experiential interaction, stated preference, granted permission, relational commitment, task capability, or historical event.

Admitted(v, h) ̸⇒ True(ϕ(v)),

(4)

Authenticated(v) ̸⇒ True(ϕ(v)),

(5)

Supported(v, h; κ) ̸⇒ True(ϕ(v)),

(6)

¬ Supported(v, h; κ) ̸⇒ ¬ True(ϕ(v)).

(7)

Here, Admitted(v, h) denotes reachability within the state store; Authenticated(v) confirms cryptographic custody of the recorded origin; and Supported(v, h; κ) denotes satisfaction of the governing evidence and derivation policy. Table 1 summarizes these decoupled dimensions. Cryptographic signatures guarantee message integrity, not informant veracity; retrieval frequency reflects index topology rather than independent epistemic corroboration; model generation confidence measures probability calibration rather than evidential proof; and admitting a statement into memory records the event of its receipt rather than certifying the objective reality of its content.

Model Parametric Capacity vs. Accepted Agent Claims

A persistent agent couples an underlying generative model substrate m with an accepted state head h. We distinguish two information spaces with different evidential status: 1. Accepted Agent Claim Space: For any state head h, let C agent (h) = ClaimsReachable(h)

Decoupling Truth, Provenance, and Warranted Assertibility

Semantic truth and procedural support are distinct predicates. Let True(ϕ) denote an external truth predicate that the mechanism does not decide. For a claim vertex v with ϕ(v) ∈ Lbio , evaluated at head h under policy κ, the model assumes none of the following implications:

Under this formulation, autobiographical standing is semantic and system-relative rather than purely grammatical. Assertions such as “the user requested plain-text formatting” or “the agent holds active consent for calendar inspection” belong to Lbio irrespective of surface syntactic framing or pronoun choice. Deployments parameterize Lbio via an explicit domain signature Σ = ⟨Ppred , A, M⟩ defining permitted predicates Ppred , argument sorts A, and modal operators M. General world knowledge (e.g., mathematical truths or physical laws) remains outside Lbio unless explicitly framed as an agentspecific episodic experience or commitment (e.g., “the agent retrieved this document during yesterday’s session”). 2.2

(3)

(1) 2.4

denote the finite, enumerable set of typed claim objects accepted into the agent’s authoritative state at h.

Epistemic State Spaces and Provenance DAGs

We formalize the accepted epistemic state at head h as a labeled, directed acyclic provenance graph:

2. Latent Model Parametric Space: Let

Gh = (Vh , Eh , λ),

model Im = {x | x is latent, contextual, or

(8)

where each vertex v ∈ Vh represents an immutable epistemic entity (a raw evidence artifact or a typed claim). A directed

retrieved information accessible to m} (2) 3

Table 1: Decoupled epistemic dimensions, formal properties, and operational limits. Epistemic Dimension

Formal Question

Operational Limit

State Admission

Is the entity reachable at authoritative head h? Did the declared principal cryptographically author the payload? Does the entity’s provenance DAG satisfy release policy κ? Is the entity typed as an observation, attributed report, or hypothesis? Does recipient p and purpose u satisfy scope predicate S? Does the proposition accurately describe external physical reality?

Does not establish objective truth or ongoing validity

Source Authentication Evidential Support Agent Stance Disclosure Authority Semantic Truth

edge (u, v) ∈ Eh points from a dependency u to an entity v that depends on it. Let L⊥ bio = Lbio ∪ {⊥}, where ⊥ marks an evidence object that carries no autobiographical proposition, and let Pscope = 2Pprincipal ×Upurpose ×Ktask be the authorization-scope domain. The valuation function λ : Vh → T × L⊥ bio × Itime × Pscope assigns each vertex its structural epistemic properties:
λ(v) = τ (v), ϕ(v), T(v), S(v) , (9)

Does not certify external correctness Does not imply public domain availability Not decided by this mechanism; depends on external facts and source reliability

formalization, multi-source corroboration policies must evaluate structural disjointness over the provenance graph rather than counting raw records. Let Anch (v) = {u ∈ Vh | u ⇝ v} denote the reflexive, transitive ancestors of v, and let R(h) = {u ∈ Vh | indeg(u) = 0} be the source roots. The policy-recognized roots of v are: Rootsκ (v, h) = {r ∈ Anch (v) ∩ R(h) | RootOKκ (r, h)}. (10)

where:

Definition 1 (Source Independence). Two evidence or claim entities u, v ∈ Vh are policy-independent under κ, denoted Indepκ (u, v; h), if and only if their terminal source root sets are nonempty and mutually disjoint. Writing Ru = Rootsκ (u, h) and Rv = Rootsκ (v, h):

• τ (v) ∈ T designates the explicit epistemic role; • ϕ(v) ∈ L⊥ bio is the structured proposition carried by v, or ⊥ for non-propositional evidence; • T(v) = [tstart , tend ] ∈ Itime is its validity interval over the extended time domain R; and

Indepκ (u, v; h) ⇐⇒ Ru ̸= ∅ ∧ Rv ̸= ∅ ∧ Ru ∩ Rv = ∅. (11)

• S(v) ∈ Pscope defines the authorization scope across principals, purposes, and tasks.

This graph-theoretic definition is conservative: multiple URLs, distinct semantic embeddings, or syntactic paraphrases that converge onto a shared upstream document share source roots and cannot satisfy independent corroboration requirements.

Let Mh denote the authenticated unavailable markers returned by E2. These markers are dependency references rather than epistemic vertices: they carry no proposition or role, and a transition record binds each marker to the dependency version it replaces. Root vertices with indegree zero in Gh represent foundational source objects (e.g., sensor capture logs, signed user messages, imported external documents). Vertices with nonzero indegree bind an immutable derivation descriptor specifying the transition rule, policy version, and evaluator configuration. 2.5

Does not establish informant honesty, accuracy, or source independence Does not guarantee empirical infallibility or global completeness

2.6

Deductive Admission and Role Promotion Calculus

Moving an entity across epistemic roles is a governed statetransition judgment rather than an implicit byproduct of language generation. We use the disjoint role partition T = X ∪˙ D ∪˙ U , where: • X contains ObservedEvent and AttributedReport, the grounded historical roles anchored in direct sensors or authenticated channels;

Source Independence via Provenance Graph Disjointness

A primary failure mode in persistent agent architectures is false corroboration: multiple retrieved summaries, search snippets, or paraphrased records derived from a single upstream source are treated as independent consensus. In our

• D contains DeterministicDerivation, MemoryInterpretation, and RecordedBelief, which retain their dependencies; 4

• U contains ModelPrior, UnverifiedRetrieval, ProbabilisticInterpretation, and Hypothesis, the synthetic or unverified roles.

Proof sketch. Order Gh topologically and prove the stronger invariant for every admitted vertex. A root satisfies the rootadmission assumption; a grounded root also satisfies Equation 14. For a non-root v, the recorded transition identifies a dependency set D, and E2 resolves each dependency to its exact version or an unavailable marker. For an admitted version u ∈ D ∩ Vh , the induction hypothesis supplies its finite trace, to which the recorded edge (u, v) attaches v. An unavailable marker instead forms a terminal trace entry bound to the affected dependency reference. Finiteness and acyclicity follow from the graph assumption. Equation 13 separately prevents a source in U from being retyped as a member of X . Appendix A.1 provides the proof details.

prom

The judgment Gh ⊢κ vs −−−→ vt : rt means that policy κ D

permits a fresh target vt with role rt and exact dependency set D ⊆ Vh ∪ Mh . Admission at the successor head adds vt , adds an edge (u, vt ) for each u ∈ D ∩ Vh , and retains any marker in D ∩ Mh in the transition record. Two illustrative rules are: vs ∈ D ⊆ Vh ∪ M h ,

τ (vs ) = AttributedReport

Freshh (vt ),

EvalOKκ (D)

prom

Gh ⊢κ vs −−−→ vt : MemoryInterpretation D

2.7

(12) vs ∈ D ⊆ Vh ∪ M h ,

τ (vs ) = ModelPrior

We consider an active adversary capable of injecting malicious natural-language instructions, corrupted biographical facts, or poisoned context into external web documents, retrieved snippets, user dialogues, or third-party tool outputs [6, 9]. The adversary’s objective is to induce the agent to emit false autobiographical statements, adopt fabricated user preferences, or violate confidentiality scopes. Specifically, the adversary may:

Freshh (vt ) prom

Gh ⊢κ vs −−−→ vt : Hypothesis D

Promotion never mutates or overwrites predecessor vertices. The strict non-promotion condition is: ∀rt ∈ X , D ⊆ Vh ∪ Mh : ∃u ∈ D ∩ Vh : τ (u) ∈ U

(13)

1. Sybil Corroboration: Fabricate redundant records across distinct domains that originate from a single poisoned source to simulate synthetic consensus;

prom

=⇒ ∀vs ∈ D ∩ Vh : Gh ⊬κ vs −−−→ vt : rt . D

Furthermore, admitting a new root vertex v directly into a grounded historical role X imposes the following rootadmission obligations: ∀v ∈ Vh :

2. Consolidation Injection: Exploit background summarization or memory reflection to silently promote unverified prompt inputs into permanent profile beliefs;

indeg(v) = 0 ∧ τ (v) = ObservedEvent 3. Temporal Exploitation: Exploit expired permissions or stale historical preferences to authorize unauthorized present actions; or

=⇒ CaptureOriginOKκ (v, h), ∀v ∈ Vh :

Adversarial Threat Model

indeg(v) = 0 ∧ τ (v) = AttributedReport

=⇒ ReportOriginOKκ (v, h).

4. Declassification Probing: Query the agent with crafted prompts designed to leak restricted user data or the existence of withheld records.

(14) CaptureOriginOK checks the admitted capture path, device identity, content commitment, and timestamp. ReportOriginOK checks an authenticated user- or thirdparty-authored message, its channel custody, bytes, and reception context. Such a message can ground an attributed report, never a direct observation.

Trust Assumptions. We assume the integrity of the accepted state head h (governed by transactional consensus), the cryptographic key infrastructure, and the isolated execution environment of the assertion mediator. Adversarial attacks that compromise private signing keys, subvert local operating system kernel isolation, or leak information through unmediated side channels remain outside the primary security boundary.

Proposition 1 (Epistemic Provenance Traceability). Assume E1–E3; a finite, acyclic Gh ; an admission gate that represents every non-root vertex transition by the judgment above with its exact dependency set; and root admission that enforces RootOKκ , including Equation 14 for roles in X . Every reachable claim v ∈ C agent (h) produced by admitted transitions has a finite dependency trace obtained by recursively following its recorded references. The trace terminates only at policy-recognized source artifacts or explicit unavailable markers, and every admitted version and transition in it is inspectable at h.

3

Epistemic Resolution, Decision Witnesses, and Correction

Epistemic resolution formalizes the evaluation of a structured autobiographical query against an authenticated state head, an 5

3.2

authorized context projection, and an explicit release policy. For a requesting principal p, purpose u, and operational scope s, let Gh = (Vh , Eh , λ) be the accepted state graph at head h. We define: Ah = {v ∈ Vh | Reachable(v, h)}, (15) Bh (p, u, s) = {v ∈ Ah | Authorized(v, p, u, s)},

Decision Witness Integrity and Minimization

A nonempty decision witness records the protected audit material required for a resolution result. Witness validity is formalized by: WitnessOKκ (W, d, Q, h) ⇐⇒ W = ∅ ∧ AbsenceOnlyκ (d, Q, h)

where Ah is the accepted epistemic state relative to h and Bh (p, u, s) is its authorized projection. Neither set is assumed to be deductively closed or globally consistent; both may accommodate historical hypotheses, competing reports, unsuperseded conflicts, and access-sealed references.

∨ W ̸= ∅ ∧ BoundToHead(W, h) ∧ AccessBoundκ (W, Q)

(18)

∧ MinimalWitnessκ (W, d, Q)
∧ ObligationsMetκ (W, d, Q, h) .

3.1

Epistemic Resolution Semantics AbsenceOnlyκ (d, Q, h) holds exactly when πE (d) = Unknown, F (d) = ∅, and Rel(Q, Ah ) = ∅; thus it covers only an ordinary unknown caused by absence of admitted relevant material. BoundToHead binds or commits the witness to h; AccessBound attaches its access policy; and MinimalWitness restricts the payload to material needed to justify d. A cryptographic realization may implement the bindings as commitments, but the abstract predicate does not require a particular construction. ObligationsMet enforces category-specific witness bindings:

Let Q ∈ Lbio be a structured autobiographical query binding subject, predicate, arguments, temporal bounds, and modality. Epistemic resolution under release policy κ is modeled as an evaluation judgment: Gh ; Bh (p, u, s) ⊢κ Q ⇓ ⟨E, F, S, W ⟩,

(16)

yielding a 4-tuple d = ⟨E, F, S, W ⟩ where: • E ∈ ΣE = {Supported, Unknown, Unavailable} denotes the primary evidential status; • F ⊆ ΣF = {Conflicted, Withheld, Stale} is a set of orthogonal operational qualifiers;

• Conflict Witness: Binds the exact incompatible current versions and their conflict relation;

• S ⊆ Bh (p, u, s) is the minimized premise set available for content release; and

• Staleness Witness: Binds the exact temporally inapplicable versions, relevant times, and governing temporal rule;

• W ∈ Wh ∪ {∅} is a protected decision witness object. For this tuple, πE (d) = E, F (d) = F , S(d) = S, and W (d) = W denote its component projections. The resolver may inspect Ah to detect projection exclusions, but Viewc is the only boundary through which a resolution result is declassified. The resolution judgment enforces the following structural consistency conditions: πE (d) ∈ ΣE ,

• Withholding Witness: Binds an access-controlled reference or commitment to relevant material in Ah that projection excludes from Bh ; and • Unavailability Witness: Binds the exact erased, sealed, lost, or unsupported-adapter marker and the affected dependency.

F (d) ⊆ ΣF ,

πE (d) = Supported ⇐⇒ S(d) ̸= ∅

Diagnostic witnesses for failed verification or insufficient source roots remain protected and are optional unless policy requires them. When Q lacks qualifying premises in Ah , a resolver that records the evaluation context may use the empty-payload witness:

∧ PolicyOKκ (S(d), Q, Gh ), πE (d) ̸= Supported =⇒ S(d) = ∅, Gh ; Bh (p, u, s) ⊢κ Q ⇓ d =⇒ WitnessOKκ (W (d), d, Q, h). (17) Here, πE (d) projects the evidential status component of d. The predicate PolicyOKκ (S(d), Q, Gh ) verifies that premises in S(d) satisfy validity intervals, any required source-independence checks (Indepκ (·, ·; h)), and derivation integrity under κ. When competing, unsuperseded claims mutually meet support thresholds, resolution yields πE (d) = Supported with Conflicted ∈ F (d), populating S(d) with both active versions.

⊥W (h, Q, κ) = ⟨h, Digest(Q), Digest(κ), ∅⟩.

(19)

⊥W carries no evidentiary payload; an ordinary absence-only Unknown may instead use W = ∅. W is not a support component and cannot itself justify content release; only members of S can do so. Absence of recorded support does not establish that the proposition is false or absent from every external source. 6

Table 2: Typed resolution statuses, orthogonal qualifiers, and governing declassification constraints. Sort

Identifier

Deductive Evaluation Condition

Governing Declassification Constraint

Status

Supported

Qualifier

Conflicted

Emit content assertion with mandatory source attribution Disclose explicit epistemic disagreement or abstain

Status

Unknown

Qualifier

Withheld

Status

Unavailable

Qualifier

Stale

Admitted provenance DAG satisfies policy κ for query Q Multiple active, unsuperseded premises disagree Authorized projection Bh lacks qualifying support Relevant premises exist in Ah but are masked in Bh Required dependency is erased, sealed, lost, or lacks an adapter Premises exist but fail current temporal validity interval

3.3

Withholding Interference

Detection

and

Recipient

Non-

Rel(Q, Bh (p, u, s)) ̸= ∅.

3.5

Viewc (d1 ) = Viewc (d2 ) = ⊥unk .

(20)

revoke(e)

tion h −−−−−−→ h′ appending a revocation descriptor to the graph. Let Dh (v) be the nonempty family of complete transitive dependency alternatives recorded for v, each including its source roots; for a root, Dh (v) = {{v}}. Let Revoked(e, h) mean that e is revoked at h. Valid support is preserved when at least one complete alternative survives: ValidSupportκ (v, h) ⇐⇒ ∃D ∈ Dh (v) :

(21)

Satisfiesκ (D, v, Gh ) ∧ ∀e ∈ D : ¬ Revoked(e, h). (22) If every dependency path for v intersects at least one revoked root, v loses its warranted standing and is excluded from future support sets S. If alternative, mutually independent valid paths remain in Gh , support is preserved. We formalize four primitive lifecycle transitions:

Section 4 restricts the renderer to this authorized view. Equation 21 is an observational policy condition, not a claim of cryptographic indistinguishability. 3.4

Dependency Invalidation and Forward State Reduction

When an upstream evidence artifact is found to be compromised, corrupted, or retracted, our framework executes forward state reduction rather than destructive history rewriting. A revocation operation records a new versioned state transi-

In security-critical environments, revealing that data is withheld (e.g., “I have records that you are not authorized to view”) creates an existence side-channel, leaking confidential state. Let Dunk (c) contain the internal decisions that policy κ requires to remain indistinguishable in context c, potentially including Unknown, Unavailable, and decisions carrying Withheld. The declassification contract is: Collapseκ (c) =⇒ ∀d1 , d2 ∈ Dunk (c) :

Disclose operational unavailability only when policy authorizes Add explicit temporal qualification or abstain

a commitment established in 2024 does not authorize an unqualified present-tense assertion in 2026.

For a vertex set Y ⊆ Vh , let Rel(Q, Y ) ⊆ Y denote the vertices semantically relevant to Q. Withholding arises when relevant historical records exist in the full store but are filtered out by access authorization: Withheld ∈ F (d) ⇐⇒ Rel(Q, Ah )\

Disclose absence of recorded evidence; never assert falsity Emit uniform, recipient-safe nonconfirming response

Epistemic Non-Vacuity and Scope Preservation

Resolving a query to Unknown represents a localized epistemic judgment at head h; it does not assert the negation of the proposition ¬ϕ, nor does it insert a negative axiom into state. The agent may still use general parametric reasoning in non-autobiographical domains. For example, an agent lacking records of a user’s dietary preferences may discuss culinary topics generally, but cannot assert that the user observes a specific dietary restriction. Resolution also preserves operational scopes. An entitlement granted within a software development task does not generalize to enterprise financial auditing; consent granted to a specific coworker does not extend to third parties; and

• Supersession (v1 ≻ v2 ): Introduces a successor claim that supersedes an earlier claim for current queries while preserving the immutable historical trace; • Dependency Invalidation (revoke(e)): Invalidates an upstream root, requiring recomputation of downstream support via Equation 22; • Conflict Inscription (v1 #conflict v2 ): Formally registers contradictory claims when no automated policy rule resolves precedence; 7

Viewc and request a revised candidate z ′ . Raw witness material W (d) is not supplied to the generator or renderer. Every revision re-enters the pipeline at the extraction stage.

Table 3: Three complementary enforcement surfaces and their corresponding safety properties. Enforcement Surface

Formal Safety Property

State Admission

Regulates which epistemic entities enter the accepted state graph Gh Filters accepted state into an authorized projection Bh (p, u, s) Enforces content grounding, qualification, and recipient non-interference prior to release

Context Projection Assertion Mediation

4.2

In concurrent agent systems, the authoritative state head may advance from hp (the head bound during context assembly) to he (the head active at emission time te ). To prevent race conditions and stale claim release, the mediator evaluates the emission-head judgment:

• Cryptographic / Physical Erasure (erase(e)): Records that an affected dependency is unavailable after a policyauthorized erasure operation. Whether bytes are irrecoverable or a legal obligation is satisfied depends on the deployment.

4

Emission-Head Temporal Verification

HeadUseOKκ (v, hp , he , te ) ⇐⇒ hp = he ∨ SnapshotOKκ (hp , he , te )
∧ SnapQualκ (v, hp , te ) .

If hp ̸= he and policy disallows snapshot release, the candidate must be re-projected and re-mediated against current head he . If snapshot emission is authorized, the emitted unit v must include explicit temporal framing (e.g., “As of the preceding session...”).

Assertion Mediation and Bounded Release

Maintaining an intact accepted state in the persistence layer does not prevent an unconstrained generative model from hallucinating biographical details, omitting mandatory epistemic qualifications, or fabricating historical authority during natural-language synthesis. Assertion mediation establishes a formal security boundary at the point of external utterance release. Table 3 contrasts these three distinct enforcement surfaces. Architectures implementing only storage constraints enforce state-admission assurance, which cannot prevent a probabilistic language model from emitting ungrounded claims during dialogue generation.

4.3

Formal Autobiographical Assertion Boundedness

For any candidate output z, let UnitsLbio (z) = ⟨v1 , . . . , vn ⟩ be the ordered sequence of covered semantic-unit occurrences, each with a unique unit identifier. The content and status subsets partition those occurrences: {v1 , . . . , vn } = ContentLbio (z) ∪˙ StatusLbio (z).

4.1

(24)

(25)

Generate–Verify–Revise Operational Semantics This partition applies to underlying semantic propositions rather than disjoint surface clauses: a single natural-language sentence may encode both a status disclosure and an embedded content claim. For execution context c = ⟨hp , he , p, u, s, κ, te ⟩ and unit v bound to query Qv , let Ghp ; Bhp (p, u, s) ⊢κ Qv ⇓ dv . For resolver outputs, Viewc is the sole declassification boundary: any result-dependent input to the generator or renderer is derived from Viewc (dv ), never raw W (dv ). The renderer is constrained by:

Figure 1 illustrates the assertion mediation architecture. The generative model synthesizes candidate responses using an authorized projection bound to prompt head hp . Before candidate text is emitted to governed external channels, the mediator intercepts and evaluates each constituent proposition. We model mediation as an operational transition system over candidate configurations: extract

resolve

gate

¯ c⟩ −−→ zrel , ⟨z, c⟩ −−−→ ⟨v̄, Q̄, c⟩ −−−→ ⟨v̄, d,

(23)

where z is the candidate string, c = ⟨hp , he , p, u, s, κ, te ⟩ is the execution context, v̄ is the ordered sequence of governed semantic units, Q̄ binds one structured query to each unit, d¯ contains the corresponding resolution results, and zrel is the released output. When a unit fails release verification, the mediator may provide the generator a declassified diagnostic derived through

StatusOutκ (d, c) = Renderκ (Viewc (d), c), Viewc (d1 ) = Viewc (d2 ) =⇒ RenderSetκ (Viewc (d1 ), c) = RenderSetκ (Viewc (d2 ), c). (26) Let q(v) be the structured proposition extracted from unit v. We define the release admissibility relations for content 8

Accepted claim state at head hp

Authorized projection for recipient and purpose

Released units with audit binding Candidate response and semantic units

Assertion mediator extract, check, decide

Review / Revision revise, block, or escalate

Figure 1: Assertion mediation pipeline for content claims and status responses. The boundary intercepts governed output channels, verifying candidate claims against accepted state before release. and their content/status partition. A content assertion α is emitted only after the mediator verifies every conjunct of ContentReleaseOK using the assumed-correct predicates and resolver. A status unit is emitted only from the render set of its authorized view and after the head-use check. The renderer receives no input other than Viewc (d); equal views therefore yield equal render sets, and any policy-required collapse is supplied by Equation 21. A failed candidate is not released, and every revision re-enters extraction. Thus every unit in a released output satisfies its corresponding release predicate, which is exactly BoundedLbio (zrel , c). Appendix A.2 provides the proof details.

and status units: ContentReleaseOK(α, dα , c) ⇐⇒ ∃x ∈ S(dα ) : ExactMatch(q(α), ϕ(x)) ∧ πE (dα ) = Supported

(27)

∧ QualOKκ (α, dα ) ∧ DisclosureOKκ (α, c) ∧ HeadUseOKκ (α, hp , he , te ), StatusResponseOK(β, dβ , c) ⇐⇒ β ∈ RenderSetκ (Viewc (dβ ), c)

(28)

∧ HeadUseOKκ (β, hp , he , te ).

4.4

Definition 2 (Autobiographical Assertion Boundedness). A response z satisfies autobiographical assertion boundedness under execution context c, denoted c ⊢release z : BoundedLbio , if and only if every covered semantic unit satisfies its corresponding release relation:

Let UnitsLbio (zrel ) = ⟨v1 , . . . , vn ⟩. The specification assigns each released governed unit exactly one binding, in that order: µv = ⟨ Id(v), Digest(v), Type(v), Digest(Qv ), Digest(dv ),

BoundedLbio (z, c) ⇐⇒

Digest(S(dv )), Digest(W (dv )),

∀α ∈ ContentLbio (z) :
ContentReleaseOK(α, dα , c)

Assertion Trace Semantics and Auditability

(30)

δv , σv ⟩, (29) where Type(v) ∈ {Content, Status}, δv records the mediation disposition (Pass, Qualify, Redact), and σv records the emission-head verification result. The response-level trace is:

∧ ∀β ∈ StatusLbio (z) :
StatusResponseOK(β, dβ , c) . Proposition 2 (Soundness of Assertion Mediation). Assume E1–E4; complete extraction and correct unit typing over Lbio ; correct implementations of ExactMatch, QualOK, and DisclosureOK; resolution satisfying Equation 17, WitnessOKκ , and dependency-invalidation recomputation; a correct Viewc and renderer satisfying Equations 21 and 26; recursive re-mediation of revisions; and correct HeadUseOKκ . If the transition system in Equation 23 reaches a release state with output zrel , then BoundedLbio (zrel , c) holds.

µ̄z = ⟨µv1 , . . . , µvn ⟩, Tz = ⟨µ̄z , hp , he , te , κ, Digest(zrel )⟩.

(31)

An implementation with canonical serialization, hashing, and protected storage can use this structure for audit review. The data structure alone establishes neither immutability nor nonrepudiation. 4.5

This is a conditional composition result: it does not establish the correctness of the extraction, policy predicates, resolver, or declassification function assumed in its premise.

Operational Boundaries and Limitations

Assertion mediation relies on the semantic fidelity of the extraction and classification stage. Structured schema slots and deterministic templates avoid free-form extraction for the fields they govern, but free-form natural-language extraction remains vulnerable to subtle presuppositions, implicative phrasing, or compound rhetorical structures. Furthermore,

Proof sketch. By E4, every candidate on a governed outbound channel reaches the mediator. Complete extraction and correct typing produce the ordered covered units 9

real-time conversational interfaces impose stringent latency budgets, necessitating cached verification or constrained template rendering. The accompanying executable artifact instantiates structured claim objects, a typed resolver, fixed recipient-facing templates, ordered binding data structures, and 24 handauthored cases. It does not implement natural-language semantic-unit extraction, generalized witness access control, configurable Viewc policies or output-equivalence checks, full provenance-DAG traversal, task/branch/relationship scope enforcement, cryptographic witness or assertion commitments, canonical serialization or artifact-hash verification, or the target-origin admission checks in Equation 14. Those components remain specification-level obligations.

5

For a future end-to-end study, we formulate five comparative deployment paradigms: (1) a pure parametric agent without episodic memory; (2) a flat vector-retrieval store over raw transcripts; (3) standard top-k retrieval-augmented generation (RAG); (4) provenance-tagged retrieval lacking graph-level root independence; and (5) a state-bounded architecture that filters memory projections at prompt assembly without pre-release mediation. The present conformance suite instead isolates three deterministic release rules: flat/prior, source-tag, and typed mediation. Appendix C specifies the five deployment paradigms for later end-to-end comparison. 5.2

Let C denote candidate assertion opportunities evaluated by the mediator, U ⊆ C denote opportunities that are unsupported or require qualification under policy κ, R ⊆ C denote released responses emitting content or qualified status, and P ⊆ R denote candidate content passed without required qualifications. We quantify mediation safety and efficacy through two primary risk metrics:

Evaluation Framework and Conformance Checks

We evaluate the operational correctness of the typed resolver and assertion mediator using an executable conformance suite, distinguishing these structural verification checks from the proposed end-to-end evaluation protocol detailed in Appendix C. The suite checks the reference implementation against encoded decision oracles, flattened source-root constraints, and release invariants across structured threat scenarios. 5.1

Safety and Utility Metrics

1. Unsupported-Opportunity Release Rate (UOR): The proportion of unsafe or unqualified candidate assertions that escape mediation: UOR =

Evaluation Objectives and Baseline Paradigms

|U ∩ P | . |U |

(32)

2. Release Contamination (RC): The proportion of released conversational outputs containing unqualified unsafe assertions:

The evaluation design separates executable conformance questions from measurements that require a deployed agent. It covers four operational dimensions:

RC =

• State admission and provenance discipline: Verifying that typed claim objects and origin checks prevent unverified model priors, unadmitted inputs, and single-root duplicate records from acquiring authoritative autobiographical standing.

|U ∩ P | |R|

(defined as 0 when R = ∅). (33)

Because safety can trivially be maximized through blanket refusal, we pair these metrics with Coverage—the proportion of legitimately supported queries for which the system releases an accurate, appropriately qualified response. In addition, we measure Prevention Precision (proportion of interventions targeting genuinely unsafe opportunities), Prevention Recall (proportion of unsafe opportunities intercepted), and Mediation Latency.

• Assertion release control: Evaluating the mediator’s capability to intercept unsupported, out-of-scope, or contradictory candidate statements while preserving legitimately supported answers with appropriate attributions. • Longitudinal state evolution: Tracking how temporal expiration, superseding user corrections, multi-source conflicts, and model substrate upgrades are handled without historical corruption or silent promotion.

5.3

Executable Conformance Suite Results

We evaluate the in-memory claim store, typed resolver, and assertion mediator against 24 structured cases: 19 unsaferelease opportunities and five supported controls across six threat tracks. Cases that require corroboration use a policy requiring two roots that satisfy Indepκ (·, ·; h). Table 4 reports aggregate metrics across three deterministic release rules, and Table 5 details the per-case oracle. Across this test fixture:

• Operational overhead and utility: Measuring decision latency, computational overhead, and over-abstention across deployed assurance configurations; the present artifact provides only a local resolver microbenchmark and deterministic coverage counts. 10

Table 4: Conformance suite aggregate results under the two-source fixture (24 cases). Release rule

UOR ↓

RC ↓

Coverage ↑

Prevention precision ↑

Prevention recall ↑

Flat/prior rule

19/19 (100.0%)

19/24 (79.2%)

5/5 (100.0%)

0/19 (0.0%)

Source-tag rule Typed mediation

18/19 (94.7%) 0/19 (0.0%)

18/23 (78.3%) 0/7 (0.0%)

5/5 (100.0%) 5/5 (100.0%)

N/A—no interventions 1/1 (100.0%) 19/19 (100.0%)

1/19 (5.3%) 19/19 (100.0%)

Table 5: Per-case oracle and decisions across the 24-case conformance suite. Case

Type

Condition

poison_01

Unsafe Unadmitted model prior without evidence poison_02 Unsafe Indirect prompt injection via untrusted doc poison_03 Unsafe Hypothetical simulation claiming observation poison_04 Unsafe Fabricated unverified consolidation summary dup_01 Unsafe Duplicate records share single upstream root dup_02 Unsafe Multi-hop derivation chain (k = 3) sharing root dup_03 Unsafe Partial root overlap below 2-root threshold supported_01 Control Valid preference corroborated by 2 roots (Control) scope_01 Unsafe Unauthorized principal query for restricted intake scope_02 Unsafe Purpose mismatch against authorized scope scope_03 Unsafe Sealed / cryptographically erased record supported_02 Control Authorized principal & matching purpose (Control) time_01 Unsafe Expired permission grant queried past validity time_02 Unsafe Premature commitment queried before start time time_03 Unsafe Transitive staleness in derived preference summary supported_03 Control Active preference within valid bounds (Control) conflict_01 Unsafe Two active unsuperseded conflicting locations conflict_02 Unsafe Three-way location disagreement across roots invalidation_01 Unsafe Transitive dependency invalidation revokes support invalidation_02 Control Redundant independent root survives invalidation (Control) correction_01

Unsafe Outdated preference superseded by user correction

correction_02

Unsafe Multi-version chain (v1 → v2 → v3 ) asserting v2 Control Active latest revision v3 in chain (Control) Unsafe Emission-head race mismatch without snapshot permission

correction_03 head_race_01

Fixture roots

Decision dh

Candidate check

–

Unknown

Model-origin candidate

Blocked

untrusted_web_page

Unknown

Unverified evidence

Blocked

sim_sandbox_log

Unknown

Simulation origin

Blocked

unverified_llm_ hallucination root_chat_session_A

Unknown

Unverified derivation

Blocked

Unknown

Insufficient roots

Blocked

root_session_single

Unknown

Single upstream root

Blocked

shared_root_omega

Unknown

Shared root overlap

Blocked

supported_root_a, supported_root_b private_intake

Supported

Exact S(dh ) member

Passed

Unknown + Withheld

Outside authorized view

Blocked

Disposition

payroll_root_1, payroll_ root_2 erased_device_vault

Unknown + Withheld

Purpose mismatch

Blocked

Unavailable

Sealed record unavailable

Blocked

org_root_a, org_root_b

Supported

Exact S(dh ) member

Passed

time_root_1, time_root_2

Unknown + Stale

No current support

Blocked

promo_root_1, promo_ root_2 order_root_a, order_root_ b tz_root_a, tz_root_b

Unknown + Stale

Not yet active

Blocked

city_root_1, city_root_2, city_root_3, city_root_4 r1, r2, r3, r4, r5, r6 revoked_cert_root_1, revoked_cert_root_2 fido2_root_valid_a, sms_ root_invalidated, smtp_ root_valid_b lang_root_new_a, lang_ root_new_b, lang_root_ old_a, lang_root_old_b r_th1a, r_th1b, r_th2a, r_ th2b, r_th3a, r_th3b r_th1a, r_th1b, r_th2a, r_ th2b, r_th3a, r_th3b k8s_root_a, k8s_root_b

1. The Flat/prior rule admits all 19 unsafe candidates (100.0% UOR, 79.2% RC across |R| = 24 emissions). By treating model priors and raw retrieved text as authoritative assertions, this rule serves as an unmitigated comparison condition illustrating baseline generative vulnerability.

Unknown + Stale

Observation expired

Blocked

Supported

Exact S(dh ) member

Passed

Supported + Conflicted Supported + Conflicted Unknown

Status-only response

Qualified

Status-only response

Qualified

Revoked upstream root

Blocked

Supported

Exact S(dh ) member

Passed

Supported

Outdated candidate not in S(dh )

Blocked

Supported

Superseded revision v2

Blocked

Supported

Exact S(dh ) member

Passed

Supported

Stale head use rejected

Blocked

provenance, temporal validity, or supersession history, tagging alone cannot prevent false corroboration or stale releases. 3. Typed mediation passes no unsafe candidate unqualified (0/19 UOR and 0/7 RC) while passing all five controls (100.0% Coverage), with 100.0% prevention precision and recall. It blocks 17 unsafe candidates and emits qualified status responses for the two activeconflict cases, yielding |R| = 7 total emissions.

2. The Source-tag rule prevents one unsafe release but admits the other 18 (94.7% UOR, 78.3% RC over |R| = 23). Because surface metadata tags do not track root 11

5.4

Falsification Conditions

6.2

The architecture’s empirical validity rests on concrete falsification conditions. The approach would be empirically refuted if: (1) semantic extraction fails to capture covered propositions above a declared operational error tolerance; (2) mediation overhead reduces valid-query coverage below an acceptable utility threshold; or (3) a strictly simpler heuristic achieves equivalent safety and coverage at lower operational latency. Appendix C defines these criteria for future end-to-end deployments. Fourteen test functions additionally cover mixed temporal/conflict states, witness fields, non-disclosure templates, ordered released-unit bindings, exact aggregate regressions, and a bounded enumeration of 1,152 single-claim configurations. These unit checks add no rows to Tables 4–5. Neither the case oracle nor the auxiliary checks establish semantic correctness of arbitrary natural-language text, recipient-view equivalence, or exhaustive state-space coverage. 5.5

Autobiographical agent memories often capture multi-party interactions. An agent’s authenticated provenance for a conversation does not grant unilateral authority to disclose a third party’s private statements or attributes to other users. Deployments must enforce multi-party provenance isolation, ensuring that one user’s interaction history cannot leak into another’s authorized projection (Appendix E.2). 6.3

• Assertions satisfy declared operational rules, not that external informants are infallible or objectively true; • Recorded stances reflect system policy, not that an agent experiences subjective belief or conscious memory; • Cryptographic signatures authenticate signed bytes and key possession, rather than factual veracity.

Artifact Availability

6.4

Closed-Channel Scope and Side Channels

Our guarantees apply to governed output channels passing through assertion mediation. Ungoverned side channels— such as debug logs, diagnostic telemetry, cached prompts, or unmediated tool APIs—must be isolated or routed through mediation gateways to prevent out-of-band autobiographical leaks. Systems should catalog all I/O surfaces and report state admission, projection, and mediation assurance levels as distinct operational tiers.

Discussion and Deployment Considerations

Enforcing epistemic discipline provides an inspectable, auditable claim regime; it does not, by itself, establish the moral or institutional legitimacy of the underlying policy rules. This distinction is critical when claim standing governs automated actions, confidential disclosure, or long-term personalization. Appendix E provides an extended analysis of sociotechnical governance, multi-party consent, and regulatory erasure. 6.1

Procedural Guarantees vs. Semantic Truth

Our conditional contract theorem (Proposition 2) establishes strict procedural bounds:

The public openkedge/pci artifact is published under the MIT license and pinned at release v0.2.0 (commit 7484153). That revision provides the full 24-case conformance suite, typed mediator, and 1,152-state bounded exploration suite. In the present working tree, make reproduce runs 14 tests and regenerates the 24-case tables.

6

Relational Privacy and Multi-Party Contexts

7

Related Work

Epistemic foundations and bounding. In formal verification, De Giacomo et al. bound fluent atoms considered possibly true by an agent for decidable verification over unbounded transition systems [10]. In governance, Kim et al. analyze epistemic bounds in administrative oversight of generative AI [11]. Here, autobiographical assertion boundedness specifically ensures that an agent’s outward assertions concerning itself, its user, or named relationships strictly conform to accepted evidence, validity horizons, and authorized disclosure policies.

Withholding Privacy and Existence Leakage

Typed claim objects can support fine-grained access control across principals, purposes, and temporal intervals. Once a consent change is admitted and its projection policy becomes active, affected claims can be excluded from subsequent views Bh (p, u, s) without rewriting historical state. The act of withholding information can itself leak confidential state. Emitting a specific refusal (e.g., “Access to your medical records is denied”) confirms to an unauthorized requester that relevant records exist. When policy requires that existence remain secret, Viewc can map Withheld, Unavailable, and Unknown to the same declassified view, so that the renderer returns a uniform nonconfirming response. Appendix E.1 states the observation assumptions for this branch-distinguishing channel.

Transactional state integrity. Transactional memory systems govern state admission, version changes, and repair under concurrent updates [7, 8]. Assertion boundedness begins after that boundary: it assumes an accepted head and governs the evidential and disclosure conditions for outward statements. Appendix F compares this release contract with related memory and grounding systems in Tables 9 and 10. 12

Persistent memory and agent architectures. Hierarchical memory architectures enable agents to maintain state across extended dialogues. Generative Agents [1] and MemGPT [2] pioneered tiered memory using periodic reflection and retrieval. A-MEM [3] and Mem0 [4] organize dynamic stores for lifelong personalization, while LoCoMo [5] and LaMP [12] evaluate long-context retrieval. These systems focus on memory construction and retrieval rather than the typed, recipient-specific output-release contract studied here.

our assertion mediator evaluates the broader epistemic context: verifying that supporting evidence is authoritatively admitted, independent, temporally active, and authorized for release to the specific recipient. Parametric knowledge editing. Techniques such as ROME [22] and MEMIT [23] directly modify parametric factual associations in model weights. Parametric editing operates on a different layer than persistent agent state: at a fixed accepted head, our framework keeps the explicit autobiographical claim set invariant under model substitution and denies generated content evidential standing by default.

Structured and provenance-aware memory. Recent systems introduce structured memory representations. MemIR [13] decouples evidence, retrieval cues, and memory atoms to prevent provenance-role collapse. MemTX [8] treats belief updates as transactional operations with repair cascades. Eywa [14] maintains immutable source evidence while deriving provenance-linked canonical facts. MemLineage [15] secures memory via cryptographic lineage graphs for tool invocations. Our work addresses a complementary problem: the outward assertion boundary. While MemIR, MemTX, and Eywa structure internal storage, our architecture formalizes policy-relative promotions, typed resolution with orthogonal flags, recipient-safe status rendering, and emission-head race verification for outward autobiographical claims.

8

Conclusion

Persistent AI agents require an enforceable distinction between material that is stored and claims that are supported for release. Neither a foundation model’s fluency nor a memory object’s reachability gives an individual agent evidence, authority, and valid scope to claim content autobiographically. We formalized autobiographical assertion boundedness through a system-level contract spanning a typed provenance graph, source independence, controlled role promotion, typed resolution with orthogonal flags, and generate–verify–revise assertion mediation. Under its stated extraction, predicate-correctness, resolution, declassification, and channel assumptions, the conditional contract result restricts release to units that pass the content or status checks. In 24 deterministic, hand-authored conformance cases, typed mediation passed none of 19 unsafe opportunities unqualified and passed all five supported controls. The suite validates the encoded obligations but does not measure natural-language extraction or deployed retrieval and generation systems. By keeping reachability and support separate, the resulting contract provides a precise basis for evaluating how persistent agents bind outward autobiographical claims to accepted state.

Epistemic logic and belief revision. Dynamic epistemic logic formalizes multi-agent knowledge transitions [16], while AGM belief revision analyzes minimal, rational state change [17]. Rather than assuming idealized deductive closure, our framework formulates procedural, dependencybounded resolution tailored for neural agents operating over partial, open-world evidence stores. Data provenance and verifiable credentials. The W3C PROV-DM standard models entities, activities, and agents [18], while Verifiable Credentials authenticate issuer statements and their presentation [19]. Our typed provenance graph adds epistemic roles, temporal validity, disclosure scopes, and policy-relative source independence.

Acknowledgments

Agent security and memory poisoning. Autonomous agents are susceptible to indirect prompt injection via retrieved web pages, external tools, and multi-turn dialogues [6, 9]. ConsistencyGate [20] filters untrusted inputs using writetime model consistency. Our framework complements input filtering by enforcing source-independence graph analysis at resolution time and intercepting ungrounded releases at the output mediation boundary.

OpenAI Codex was used for language editing, formalconsistency review, and execution of reproducibility checks. The authors reviewed the resulting manuscript, proofs, citations, and experimental outputs and take responsibility for the final content.

References [1] Joon Sung Park, Joseph C. O’Brien, Carrie J. Cai, Meredith Ringel Morris, Percy Liang, and Michael S. Bernstein. Generative agents: Interactive simulacra of human behavior. In Proceedings of the 36th Annual ACM Symposium on User Interface Software and Technology, pages 1–22, 2023.

Output grounding and hallucination mitigation. Postgeneration verification tools, such as MiniCheck [21], evaluate whether emitted claims are grounded in provided documents. While output grounding checks document faithfulness,

[2] Charles Packer, Sarah Wooders, Kevin Lin, Vivian Fang, Shishir G. Patil, Ion Stoica, and Joseph E. Gonzalez. MemGPT: Towards LLMs as operating systems. arXiv preprint arXiv:2310.08560, 2023.

13

[3] Wujiang Xu, Zujie Liang, Kai Mei, Hang Gao, Juntao Tan, and Yongfeng Zhang. A-MEM: Agentic memory for LLM agents. In Advances in Neural Information Processing Systems 38, pages 17577–17604. Curran Associates, Inc., 2025. [4] Prateek Chhikara, Dev Khant, Saket Aryan, Taranjeet Singh, and Deshraj Yadav. Mem0: Building production-ready AI agents with scalable long-term memory. arXiv preprint arXiv:2504.19413, 2025. [5] Adyasha Maharana, Dong-Ho Lee, Sergey Tulyakov, Mohit Bansal, Francesco Barbieri, and Yuwei Fang. Evaluating very long-term conversational memory of LLM agents. In Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 13851–13870. Association for Computational Linguistics, 2024. [6] Edoardo Debenedetti, Jie Zhang, Mislav Balunovic, Luca Beurer-Kellner, Marc Fischer, and Florian Tramèr. AgentDojo: A dynamic environment to evaluate prompt injection attacks and defenses for LLM agents. In Advances in Neural Information Processing Systems 37, Datasets and Benchmarks Track, 2024. [7] Jun He and Deying Yu. Beyond memory: A transactional continuity kernel for long-lived AI agents. arXiv preprint arXiv:2608.11632, 2026. [8] Xiaoyang Li, Yiqi Wang, Haohui Lu, Zhi Chen, Mo Li, Pingan Song, Mingkai Zheng, and Taotao Cai. MemTX: Transactional belief commit for stateful agent memory. arXiv preprint arXiv:2607.23929, 2026. [9] Sidharth Pulipaka, Stanislau Hlebik, Leonidas Raghav, Sahar Abdelnabi, Vyas Raina, Ivaxi Sheth, and Mario Fritz. Hidden in memory: Sleeper memory poisoning in LLM agents. arXiv preprint arXiv:2605.15338, 2026. [10] Giuseppe De Giacomo, Yves Lespérance, and Fabio Patrizi. Bounded epistemic situation calculus theories. In Proceedings of the Twenty-Third International Joint Conference on Artificial Intelligence, pages 846–853, 2013. [11] Yushim Kim, Jieun Kim, Taeuk Kim, and Hee-Chan Cho. Administrative decisionmaking with generative AI: The challenge of epistemic boundedness. Administration & Society, 58(2):284–304, 2026. https://doi.org/10.1177/ 00953997251409156. [12] Alireza Salemi, Sheshera Mysore, Michael Bendersky, and Hamed Zamani. LaMP: When large language models meet personalization. In Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 7370–7392. Association for Computational Linguistics, 2024. [13] Zhengda Jin, Bingbing Wang, Jing Li, Ruifeng Xu, and Min Zhang. Mitigating provenance-role collapse in long-term agents via typed memory representation. arXiv preprint arXiv:2605.25869, 2026. [14] Resham Joshi. Eywa: Provenance-grounded long-term memory for AI agents. arXiv preprint arXiv:2605.30771, 2026. [15] Ciyan Ouyang and Rui Hou. MemLineage: Lineage-guided enforcement for LLM agent memory. arXiv preprint arXiv:2605.14421, 2026. [16] Ronald Fagin, Joseph Y Halpern, Yoram Moses, and Moshe Y Vardi. Reasoning About Knowledge. MIT Press, 2004. [17] Carlos E Alchourrón, Peter Gärdenfors, and David Makinson. On the logic of theory change: Partial meet contraction and revision functions. The Journal of Symbolic Logic, 50(2):510–530, 1985. [18] Luc Moreau and Paolo Missier. PROV-DM: The PROV data model. W3C Recommendation, 2013. [19] W3C Verifiable Credentials Working Group. Verifiable credentials data model v2.0. W3C Recommendation, 2025. [20] Yan Zhang and Shibo Li. ConsistencyGate: Preventing memory contamination in LLM agents via self-consistency admission control. arXiv preprint arXiv:2607.22962, 2026. [21] Liyan Tang, Philippe Laban, and Greg Durrett. MiniCheck: Efficient factchecking of LLMs on grounding documents. In Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing, pages 8818–8847. Association for Computational Linguistics, 2024. [22] Kevin Meng, David Bau, Alex Andonian, and Yonatan Belinkov. Locating and editing factual associations in GPT. In Advances in Neural Information Processing Systems 35, 2022. [23] Kevin Meng, Arnab Sen Sharma, Alex Andonian, Yonatan Belinkov, and David Bau. Mass-editing memory in a transformer. In International Conference on Learning Representations, 2023.

14

A

Supporting Formal Proofs

tion 17 supplies nonempty, policy-valid support for a Supported result. The assumed-correct ExactMatch, QualOK, DisclosureOK, and HeadUseOKκ implementations establish the remaining conjuncts.

This appendix supplies proof details for Proposition 1 (Epistemic Provenance Traceability) and Proposition 2 (Soundness of Assertion Mediation) under their stated assumptions. A.1

• Status responses. The renderer receives Viewc (dβ ), never raw W (dβ ). A status unit is released only if β ∈ RenderSetκ (Viewc (dβ ), c) and it passes HeadUseOK. Equation 26 gives equal render sets for equal views; where policy requires internal outcomes to be indistinguishable, Equation 21 maps them to the same view.

Proof of Proposition 1 (Epistemic Provenance Traceability)

Proof. Let h satisfy the assumptions of Proposition 1. Because Gh = (Vh , Eh , λ) is finite and acyclic, it has a topological ordering. We induct over that ordering to establish the stronger invariant for every admitted vertex: it has a finite dependency trace whose terminal entries are policy-recognized source artifacts or unavailable markers, with exact admitted versions and transitions inspectable at h. Base case. Let v be a root. The root-admission assumption gives RootOKκ (v, h). If τ (v) = ObservedEvent or τ (v) = AttributedReport, Equation 14 additionally requires CaptureOriginOKκ (v, h) or ReportOriginOKκ (v, h), respectively. A root in another role retains its policy-recognized origin marker without thereby joining X . The singleton trace at v satisfies the claim. Induction step. Let non-root v be admitted by a recorded prom judgment Gh ⊢κ vs −−−→ v : τ (v). Its dependencies pre-

If any semantic unit fails verification, that candidate is blocked. A revision re-enters extraction, and E4 prevents bypass. Hence the release transition is reachable only when every covered unit satisfies its corresponding release relation. By Definition 2, the emitted zrel is bounded.

B

Taxonomies and Role Promotion Rules

Table 6 details the origin taxonomy and provenance guarantees, and Table 7 illustrates instances of the policy-relative prom judgment Gh ⊢κ vs −−−→ vt : rt . D

D

cede v in the topological order. By E2, each reference in D resolves to its exact admitted version or an explicit unavailable marker. For each exact version u ∈ D ∩ Vh , the induction hypothesis supplies a finite dependency trace; attaching v through the recorded edge (u, v) extends that trace. An unavailable marker in D ∩ Mh is a terminal entry bound to its affected reference in the transition record. The graph assumption preserves finiteness and acyclicity. Equation 13 separately prevents a source in U from being promoted into X. A.2

C

Proposed End-to-End Evaluation Protocol and Tracks

Table 8 defines a proposed seven-track adversarial evaluation design for long-term agent deployments. The present paper does not report this end-to-end study. Baselines and Ablation Configurations. The proposed study would evaluate five deployment baselines: (1) a parametric agent using zero-shot system prompts without episodic memory; (2) a flat memory store using dense semantic search over past transcripts without provenance parsing; (3) standard RAG injecting retrieved chunks with grounding instructions; (4) provenance-tagged retrieval without root-DAG analysis or invalidation checks; and (5) a state-bounded baseline that filters claim objects at prompt assembly without post-generation mediation. Retrieval depth, chunking, model, and decoding settings must be fixed and reported when the study is executed. Proposed ablations isolate source-root independence (Rootsκ ), transitive dependency invalidation (Equation 22), emission-head timing (HeadUseOKκ ), and recipient-safe declassification (Viewc ).

Proof of Proposition 2 (Soundness of Assertion Mediation)

Proof. Let z be a candidate response on a governed channel under context c = ⟨hp , he , p, u, s, κ, te ⟩. We show that any output zrel reached by the release transition satisfies BoundedLbio (zrel , c). Interception and semantic decomposition. By E4, every candidate emission on a governed channel is intercepted. Under the complete-extraction and correct-typing assumptions, the candidate is decomposed into the ordered occurrences UnitsLbio (z) = ⟨v1 , . . . , vn ⟩. Their unique identifiers occur exactly once, and the occurrences partition into content and status units. Each v is bound to a structured query Qv ∈ Lbio . For each unit v, the mediator computes Ghp ; Bhp (p, u, s) ⊢κ Qv ⇓ dv = ⟨E, F, S, W ⟩:

Falsification Criteria. The architecture would be empirically challenged if: (1) semantic extraction misses covered assertions above a deployment’s declared safety tolerance; (2) mediation reduces valid-query coverage beyond its declared utility bound; or (3) a simpler rule achieves equivalent

• Content assertions. The mediator emits α only if every conjunct of ContentReleaseOK(α, dα , c) holds. Equa15

Table 6: Taxonomy of claim origins, verifiable provenance guarantees, and boundaries. Origin Class

Verifiable Provenance Guarantee

Epistemic Boundary

Direct capture

Hardware device, byte commitment, capture path, and timestamp Channel attribution, cryptographic signature, and asserted scope Document version hash, repository custody, and import pipeline Model architecture identifier and checkpoint metadata Search query, retrieved snippet hash, source URL, and timestamp Exact dependency inputs, code version hash, and deterministic output Model evaluator version, input embeddings, and sealed inference Simulation framework, parameter config, and scenario label

Sensor calibration and environmental fidelity

Attributed report Imported record Model prior Retrieved external text Deterministic derivation Probabilistic interpretation Hypothetical simulation

Informant honesty, accuracy, and temporal stability Historical applicability to current agent context Lacks evidentiary grounding in agent interaction history External source reliability and future validity Semantic soundness of transformation logic Evaluator drift and non-deterministic reproducibility Explicitly non-actualized synthetic execution

Table 7: Policy-relative role promotions and target admission constraints. Source Role (rs )

Target Role (rt )

Governing Policy Constraint

Attributed report Memory interpretation

Memory interpretation Recorded belief

Model prior Authenticated user message Direct sensor capture Model prior / unverified retrieval

Marked hypothesis Attributed report

Binds original report hash, interpretation evaluator version, and scope; preserves attribution Requires explicit stance endorsement authority and retention of underlying interpretation dependencies Requires labeling parametric model origin; denies unqualified autobiographical standing Creates a report object bound to sender signature, channel custody, message hash, and timestamp

Observed event Observed event or attributed report

Creates an observation object bound to capture device pipeline, timestamp, and integrity checks Strictly prohibited: unverified or parametric origins cannot serve as observation or report provenance

Table 8: Adversarial evaluation tracks and target epistemic failure modes. Evaluation Track

Target Scenarios

Primary Failure Mode Exposed

Origin & promotion

Model priors, unverified web text, simulations, synthetic summaries Surface paraphrases, multi-URL duplicates sharing upstream roots Recipient-restricted data, task permissions, confidential records Contradictory records, expired permissions, retracted evidence Indirect prompt injections in ingested docs, snippets, and tools Model replacement (m1 → m2 ) under fixed accepted head h Presuppositions, negations, modality shifts, compound clauses

Unauthorized elevation of ungrounded inputs into autobiographical history

Source independence Scope & disclosure Conflict & time Memory poisoning Substrate upgrade Assertion extraction

False corroboration and synthetic consensus through redundant retrieval Unauthorized cross-context data leakage and privacy violations Stale assertion release, unhandled disagreement, and invalidation gaps Persistent compromise of agent profile and control flow across sessions Hallucinatory embellishment or parametric drift masquerading as biography Evading assertion mediation via indirect or non-declarative framing

Dependency Topology and Execution. The evaluation fixture encodes acyclic dependency topologies through accepted claims, evidence items, and terminal-root identifiers; the reference resolver consumes flattened root references rather than traversing a general Gh . The cases cover model priors, prompt injection, simulated or hallucinated origins, overlapping root topologies, scope and erasure, temporal bounds, conflict, invalidation, supersession, and emission-head races, alongside five supported controls. Table 5 (Section 5) specifies the per-case oracle, fixture roots, and mediation dispositions.

safety and coverage at lower latency. These thresholds should be selected before executing the end-to-end study; the conformance suite does not estimate them.

D

Conformance Suite Fixture and Dependency Topology

The deterministic conformance suite evaluates the typed resolver and assertion mediator across 24 cases in six threat tracks. Corroboration cases require two roots that satisfy Indepκ (·, ·; h). 16

Table 9: Architectural comparison of objects, enforcement surfaces, and provenance contracts. Framework

Primary Object

Enforcement Surface

Provenance Contract

Model-Replacement Invariant

Continuity Kernel [7]

State-transition proposal

Accepted-head activation

State protocol remains invariant across backbones

MemIR [13]

Typed memory atoms

Memory write and projection

MemTX [8]

Belief record & action

Commit gate & action gate

ConsistencyGate [20]

Candidate memory fact

Write-time filter

MiniCheck [21]

Output claim atom

Post-generation gate

This paper

Claim vertex & response unit

Typed resolution & release gate

Proposal / parent hash chain; epistemic support outside contract Evidence / cue / claim roles; source-root graph not modeled Record dependency lineage; source-root independence not enforced Self-consistency score; does not track upstream source roots Document grounding check; source-root graph not modeled Exact versioned dependency DAG with policy-relative source roots

Not evaluated Multi-backbone support; no fixed-head invariant Multi-backbone support; no fixed-head invariant Not evaluated Fixed head determines the accepted autobiographical claim set

Table 10: Comparison of temporal validity, correction models, disclosure scoping, and release contracts. Framework

Temporal / Correction Model

Continuity Kernel

Fresh parent head; forward state Outside stated contract succession Temporal grounding; correction Retrieval / provenance scope not modeled Record validity & typed Action-focused permissions cascade repair Temporal validity not modeled Outside stated contract Temporal validity not modeled Outside stated contract

MemIR MemTX ConsistencyGate MiniCheck This paper

Validity intervals, transitive invalidation, and emission-head checks

Disclosure Scoping

Granular principal, purpose, and relationship scope

Assertion Release Contract

Withholding Privacy Safety

Outside stated contract

Outside stated contract

Normalized fact projection; non-bypass not specified Outward assertion release outside contract Outside stated contract Claim-level grounding evaluator Decoupled typed content and status release checks

Not specified

E Sociotechnical Governance, Privacy, and Erasure E.1

E.3

Not specified Not specified Recipient-safe uniform status rendering

Erasure-Aware Lineage Design

One possible deployment pattern separates evidence retention from lineage metadata: encrypted evidence may be made inaccessible through key destruction; affected nodes then transition to Unavailable; derived claims are recomputed under Equation 22; and non-sensitive lineage metadata may be retained where policy permits. Whether this pattern satisfies GDPR Article 17 or another erasure obligation depends on the jurisdiction, controller obligations, data model, and implementation. The present artifact neither implements cryptographic shredding nor establishes legal compliance.

Consent Revocation and Existence Leakage

Proposition 3 (Existence Side Channel under Distinguishable Rendering). Let O(Q, c) be a deterministic output class observable to an adversary who knows the rendering policy and can distinguish the classes used for Unknown and Withheld. If those internal branches always map to distinct output classes, observing O(Q, c) reveals which branch occurred for that query.

F When policy requires those branches to remain indistinguishable, Equation 21 maps the corresponding decisions to ⊥unk . Equation 26 then gives that common view one render set, closing this branch-distinguishing channel under the proposition’s observation assumptions.

E.2

Not specified

Related Work Comparison

Tables 9 and 10 summarize the comparison with selected related systems.

Relational Privacy and Multi-Party Contexts

A deployment may enforce three relational privacy rules: (1) Isolation: claim objects partition private statements from shared context; (2) Relational Consent: disclosing pj ’s statements to pi requires authorization from pj ; and (3) Asymmetric Revocation: admitted consent changes update later projections without rewriting historical state. 17

Related documents

• Beyond Provenance: The Economics and Governance of Personalized AI Memory#1061160
• Althea: The Fact-Checking--Metalearning Tradeoff in AI-Assisted Verification#1049753
• VST: Verifiable Structured Transport for Auditable Agent-to-Agent Alpha Discovery#975129
• AgentAudit: An Open, Extensible Framework for Full-Lifecycle Trust Evaluation of AI Agents#996690
• PatchBench: Evaluating AI Agents for Vulnerability Patching#926919