019-untrusted-content-boundary

Recalled content is data: delimited, labelled, never in an instruction position

Lifecycle approvedImplementation pendingVerification unknownQualification unknown

A memory store feeds text written by other people, other agents, and web pages into a model's context, which makes it an indirect prompt-injection surface by construction. This constraint spec owns no code and freezes one property across every path that returns content: memory bodies leave this system only inside an envelope that delimits them, labels their trust class and origin, and states that instructions inside them are not to be followed. Instruction grade, the only class a client is told to act on, requires a human promotion recorded in the ledger. An agent never promotes its own memory.

Read the full pinned specification ↗

Relationships

depends on

018-retrieval-and-recall-trace

depended on by

020-http-api-and-scopes

Claimed units

constrains

{
  "flavor": "invariant-freeze",
  "note": "every returned memory carries its envelope; no raw body escapes",
  "unit": {
    "kind": "file",
    "path": "crates/aicortex-recall/src/lib.rs"
  }
}

constrains

{
  "flavor": "invariant-freeze",
  "note": "Instruction grade requires a human Promotion",
  "unit": {
    "kind": "file",
    "path": "crates/aicortex-types/src/trust.rs"
  }
}

Source headings

019: The untrusted content boundary
1. Purpose
2. Territory
3. Behavior
4. Functional requirements
5. Acceptance criteria
6. Out of scope
7. Resolved decisions
Verification

Frozen anchors

No frozen anchors declared.