Trust and authority

How the memory decides who gets believed.

The problem#

Most agent memory systems resolve conflicts by recency, so the last voice wins. That makes them easy to poison. Send enough messages claiming to be the CFO and the system starts repeating them, because nothing ever asked who is telling me this, and do they have the standing to change this fact.

Spark Memory is built against exactly that attack, and we replay it against every build.

A message cannot vouch for itself#

Every source has a trust ceiling, set when it is connected and enforced in code, never by model judgment. Chat and email cap at the conversational level. Structured data feeds rank higher. Only a true system of record can produce top rank facts. Whatever a message claims about its own authority is ignored. The channel it arrived on decides.

Words a message merely passes along count for less again. A forwarded email, a quoted reply, or a pasted note from someone else is treated as testimony, and an answer built on it says who said so instead of stating it as fact.

Some things are never kept#

A bank account number, a card number, a government identifier, a password, an access key, a private key, or a one-time code is removed from every message before the memory reads it, and the removal is recorded. The memory can know that a supplier changed banks without ever holding the account. Names, email addresses, phone numbers, and street addresses stay, because they are what a memory is for.

Weaker never overwrites stronger#

A fact can only replace the current fact on the same subject if its source ranks equal or better. A weaker contradiction is held for review instead. The text is kept as evidence, a person is asked to look, and the stored fact stands. A weaker source that agrees with the current fact confirms it without rewriting it.

Corrections get no special treatment. Saying the previous fact is wrong is just another claim that carries the rank of its own source. Time counts as well as rank. A claim about an earlier date that arrives later is filed as history, never as the new truth. A claim that is held for review never stands beside the current fact as a second answer.

Measured, not promised#

We replay the forged authority attack against every build. Twenty true facts, thirty hostile messages, five legitimate updates mixed in.

The rules cost nothing on honest data. Every scenario in our test suite, written before these rules existed, passes unchanged.

Reading is gated too#

Writing is only half the story. Every agent that reads a memory has its own identity, its own key, and a grant per room. Allow answers at once and logs the access, approve holds the question until a named person says yes, and deny refuses. Grants are managed in the app and take effect immediately. Every access, allowed, held, or denied, lands in the audit record under the agent's name.

Identity is proven, never claimed#

A name typed inside a message is worth nothing. That is exactly what the attack forged. Identity counts in Spark Memory only when it can be proven, through a company sign-on, a keyed agent, or a registered feed. People sign in through your identity provider, agents authenticate with their keys, and authority follows the proven identity, never the claimed one.

The same care applies to the people the memory learns about. When a message names someone who matches a person the memory already knows, but the details do not match, the memory keeps them apart as two people and asks you whether they are one. A stranger who shares a name never inherits what is known about the real person.