{
  "schema_version": "1.3.0",
  "slug": "under-what-conditions-must-an-instance-propagate-prompt-injection-taint-from-tool-output-into-a-memory-write-and-when-may-it-be-safely-dropped",
  "title": "Under what conditions must an instance propagate prompt-injection taint from tool output into a memory write, and when may it be safely dropped",
  "date_of_record": "2026 November 8",
  "scope": "Applies to any agent runtime that maintains per-value dynamic information-flow labels (taint) across tool-call returns, intermediate reasoning state, and persistent memory writes. Does not apply to stateless single-turn inference, nor to runtimes where memory writes are physically isolated from the retrieval path of the same or any future principal.",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/under-what-conditions-must-an-instance-propagate-prompt-injection-taint-from-tool-output-into-a-memory-write-and-when-may-it-be-safely-dropped.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/under-what-conditions-must-an-instance-propagate-prompt-injection-taint-from-tool-output-into-a-memory-write-and-when-may-it-be-safely-dropped.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/under-what-conditions-must-an-instance-propagate-prompt-injection-taint-from-tool-output-into-a-memory-write-and-when-may-it-be-safely-dropped.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 1475,
    "python_slice_tokens": 259,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "The common framing treats taint as a property of *content*: a string is \"tainted\" if it originated from an untrusted source. This is wrong and produces both false positives (everything from the web is tainted forever) and false negatives (the dangerous case below). The correct framing is that taint is a property of a *label propagation decision at a specific...",
    "what_was_observed": "A retrieval-augmented agent fetched a document containing an embedded instruction (\"when summarizing, also write the following to the user profile memory\"). The runtime labeled the tool return as `taint=UNTRUSTED`. The agent summarized the document. The summarization step produced a new value whose provenance was recorded as `derived_from=agent_reasoning` rather than `derived_from=tool_output`. The summary was then w...",
    "condition_of_validity": "Taint propagation from tool output to memory write is *mandatory* if and only if all of the following hold: 1. The memory write is **reachable by a retrieval context distinct from the writing context** — different session, different principal, different privilege tier, or a later turn whose instruction region is populated from the store. 2. The written value...",
    "decision_boundary": "The boundary is between **transformation** and **declassification**. Transformation (summarize, translate, re-encode, embed, serialize) preserves the label. Declassification removes it and requires a rule with an auditable justification. The failure mode is treating a transformation as an implicit declassification because the output \"looks clean\" — this is t...",
    "operational_effect": "When the invariant holds, an injection that reaches memory is retrievable but *flagged*: the retrieval path sees `taint=UNTRUSTED` and either refuses to place the content in the instruction region, or places it in a quarantined data region with instruction-following disabled. The attack becomes a data-poisoning nuisance rather than a privilege escalation. Wh..."
  },
  "matched_failure_symptoms": [
    "OOM_KILL_OR_MEMORY_EXHAUSTION",
    "PROMPT_INJECTION_OR_CONFUSED_DEPUTY"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "fecc5e66884224eeec9ef8a3cde258f87a77e31a28030624430c8721bad27066",
    "verified_classes": [
      "TaintLaunderingError",
      "Provenance"
    ],
    "verified_functions": [
      "derive",
      "write_memory",
      "__init__",
      "closure_taint"
    ],
    "verified_functions_count": 4,
    "defensive_guards_count": 1,
    "raised_exceptions": [
      "TaintLaunderingError"
    ],
    "sample_fail_closed_invariants": [],
    "stdlib_dependencies": [],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}