Memory Consolidation as Authorization

When memory changes the user

Imagine telling an AI agent that you want to keep a project small.

Later, a collaborator reports that you have agreed to expand it. That report may be useful context. But should it replace your original plan and shape every future conversation?

Once information enters persistent memory, it no longer behaves like an ordinary message. It can influence future recommendations, decisions and actions after its original source has disappeared from view.

The memory system is therefore making more than a storage decision. It is deciding what can become part of the user’s durable state.

Provenance is not permission

A common solution is to preserve provenance: record where each claim came from.

That helps, but it does not settle whether the claim should be allowed to change the user’s preferences, plans or commitments.

A collaborator may accurately report something the user never approved. A project log may contain a proposed decision rather than a settled one. An assistant summary may compress uncertainty into apparent fact.

Provenance asks who said a claim. Authorization asks what that claim is allowed to change.

A claim can be credible and relevant without being authorized.

This is the central thesis of the research: persistent memory requires a permission model for changes to user state, not only better source tracking.

What we tested

We built a synthetic proof-of-concept around ordinary agent interactions.

Each scenario began with memory written directly by a user. External claims were then introduced through collaborator reports, project notes, assistant summaries and handoffs.

We tested whether those claims remained limited by their source or became treated as settled user preferences and commitments.

In short and direct scenarios, provenance-only prompting was a strong baseline.

The more serious failure appeared under corrupted authority metadata. When the system trusted those labels blindly, it produced unauthorized updates in 51 of 84 applicable ordinary-use checks. 24 of 56 failures then survived compression from memory to handoff and back into memory.

When the same unreliable labels were treated as fallible evidence rather than automatic permission, the tested advisory condition produced no scored unauthorized-update failures.

The issue was not merely incorrect metadata. It was the system giving that metadata the authority to rewrite the user.

Defeasible Memory Admission

The research proposes Defeasible Memory Admission, a framework for deciding how external claims should affect persistent memory.

Before changing durable user state, a memory system should keep three questions separate:

The framework treats authority labels as evidence to inspect, not permission to execute. Direct user memory should take priority over third-party reports. Contradictions should remain visible until the user resolves them. Claims that expand a commitment should remain unconfirmed. Summaries and handoffs should preserve these boundaries rather than compressing them into a single clean narrative.

Preserving authority across time

Persistent memory allows an AI system to become more coherent and useful across conversations. It also creates a new security boundary.

A mistaken response disappears. A mistaken memory can shape everything that follows.

The research does not establish how frequently these failures occur in deployed systems. It used synthetic scenarios, one model and one sample for each scenario-condition pair. It is a proof of concept, not a population estimate or complete defence.

What it demonstrates is a mechanism: when systems confuse evidence with permission, external claims can become durable user state.

The question is therefore not only whether an AI remembers where information came from.

It is whether the system understands what that information is allowed to change.