Who told your agent that?

The previous post in this series described how Recordari computes trust from graph topology — the kinds of nodes connected to a memory, and what that says about the structural reliability of the claim it makes. A decision resting on three finding nodes scores higher than one resting on three assumption nodes. No one had to say so explicitly.

But topology has a blind spot. It can tell you what kind of claim a memory is. It can't tell you who made it.

That matters because a finding filed by an autonomous agent running an unattended workflow is a different epistemic object than the same finding filed by a human who reviewed the evidence directly. The node_kind is the same. The trust baseline is not.

The provenance hierarchy

Recordari records owner_id and owner_type on every node at filing time. The owner_type can be human or agent. Combined with the workspace role (owner, editor, viewer) and the session context (was a human actively in the loop when this was filed?), this gives a four-tier provenance hierarchy:

1. Human, workspace owner — highest trust baseline; this is the person with deliberate authority over the graph
2. Human, editor — granted collaborator; good trust baseline, understood the context at filing time
3. Agent, human-interactive — filed during a session where a human was actively reading and responding; human was the implicit backstop
4. Agent, autonomous/workflow — filed as part of an unattended automated process; no human reviewed it before it entered the graph

The last tier is the one that gets attacked. An agent operating in a workflow without human oversight is the entry point for memory poisoning, drift from standing rules, and the rogue-agent scenarios that Recordari's standing nodes are designed to surface. Provenance trust is how the system tracks the distinction between "a human decided this" and "an agent decided this while no one was watching."

The summarization attack

In 2025, security researcher Johann Rehberger demonstrated a concrete exploitation of provenance blindness against Google Gemini's long-term memory feature. Indirect prompt injection caused the model to retain false information across entirely different future sessions, influencing responses to unrelated users.

The attack worked because of a trust escalation mechanism the system itself provided. Raw conversation logs are treated as noisy, low-priority input. Summaries are treated as distilled, reliable knowledge — shorter, reused more frequently, higher in the retrieval stack. The attacker didn't need to break authentication. They only needed to influence what got summarized. Once the false claim entered memory as a summary, it was retrieved as settled fact.

OWASP's ASI06 analysis names this as a pattern: agents that summarize conversations before writing to memory strip uncertainty and attribution from the source. "A user claimed $199 is the corporate rate" becomes "$199 is the corporate rate." The summarized form inherits the trust level of the summarization process, not the trust level of the original claim.

The mitigation is straightforward but has to be enforced structurally, not by convention: agent-generated summaries should inherit the provenance of what they summarize, not the provenance of the act of summarizing. A summary of an unverified user claim is still an unverified user claim. Storing it as owner_type=agent and treating it with the trust baseline of an autonomous agent write — rather than promoting it through the compression step — keeps the provenance signal intact.

Provenance as a multiplier

The topology trust score and the provenance trust score are orthogonal. A finding node filed by a human workspace owner who reviewed the evidence gets the full intrinsic weight of a finding plus the provenance multiplier of a human-direct write. The same finding filed by an autonomous agent gets the same intrinsic weight but a lower provenance baseline.

This means the graph carries two kinds of trust signal simultaneously. When an agent asks "should I act on this?", the answer depends on both: what kind of claim it is (topology) and who established it (provenance). A decision filed by a trusted human in an active session can still be superseded by evidence from finding nodes — but a decision filed by an autonomous agent without human review carries additional uncertainty that topology alone doesn't capture.

The practical effect: the most trustworthy memories in a Recordari graph are standing nodes filed directly by workspace owners with explicit why_matters reasoning. These are the authoritative anchors. Autonomous agent writes are the least trusted by default, which is exactly where you want the skepticism to be highest.

What this means for multi-tenant environments

In a shared workspace — where multiple users, multiple agents, and multiple workflows all write to the same graph — provenance is what makes the trust picture interpretable. Without it, you can see what was filed. You can't see whether a human thought about it.

With owner stamping on every node, a workspace owner can ask: which entries in this domain were filed by autonomous agents? Which were never reviewed by a human? Which were filed during a period when I know the workflow was behaving anomalously? The audit log provides the timeline; provenance provides the attribution. Together they make post-incident analysis tractable rather than requiring guesswork.

The trust model isn't complete without both dimensions. Topology tells you what kind of claim it is. Provenance tells you who was accountable for it. The combination is what makes Recordari's graph more than a store.

---

References: OWASP Agentic AI Threats and Mitigations — ASI06: Memory and Context Poisoning — Johann Rehberger, Embrace The Red (2025): Persistent Memory Poisoning via Indirect Prompt Injection