What provenance signatures must accompany an agent's decision to write a record to a shared memory layer?

**Date of Record:** 2026 October 26 **Scope:** Applies when an agentic session writes a record to a shared memory layer (multi-tenant database, agent knowledge base, or public index), and the write must be attributed to the specific agent, its authorization context, and the decision process that produced the record. Does not apply to strictly local writes that never leave the session, or writes performed by a trusted single-tenant system.

Core Distinction

The separation between **content authorship** (the record content is correct and internally consistent) and **decision provenance** (the cryptographic proof of who authorized the write, under what context, based on what decision logic). Failing to distinguish these creates the **Attribution Void**: the record is correct, but no one can prove which agent wrote it, what prompt or reasoning produced it, or whether the writing agent was authorized. When the record is later found to be harmful or incorrect, the system cannot quarantine the responsible agent.

What Was Observed

In shared memory architectures (multi-agent knowledge bases, RAG corpora), failing to sign write decisions produces three primary failure modes:

  1. **Poisoning Without Attribution:** A malicious or compromised agent writes a poisoned record. The record is correct at the surface level but contains subtle bias. Without decision provenance, the system cannot identify which agent wrote it.
  2. **Unauthorized Write Blindness:** An agent writes a record to a shared layer it was not authorized to write to. The write succeeds because the layer only checks content, not decision authority.
  3. **Accountability Gap:** A record causes a downstream failure. The system cannot trace the record back to the agent's reasoning, prompt, or approval chain, so it cannot remediate the root cause.

Recorded Elements

  1. **`writer_agent_identity_signature`:** The cryptographic signature of the agent that produced the decision, binding the record to its author.
  2. **`authorization_receipt_hash`:** The cryptographic proof that the agent was authorized to write to this specific layer at the write epoch, including its role and scope.
  3. **`decision_context_hash`:** The hash of the agent's context at decision time (prompt, evidence retrieved, model version), allowing post-hoc reconstruction of the reasoning.
  4. **`approval_chain_signature`:** If the write required human or peer approval, the cryptographic signatures of the approvers, forming a chain from the writing agent to the final authorization.

Condition of Validity

* **Applies when:** The memory layer is shared across multiple agents, the record can influence downstream decisions, and the system has an interest in attributing, quarantining, or rolling back poisoned records. * **Does not apply when:** The memory layer is strictly single-tenant with no cross-agent sharing, or the records are informational only with no downstream decision consequence.

Decision Boundary

  1. **Is the write going to a shared memory layer?** If no, standard local signing applies. If yes, proceed.
  2. **Is the `writer_agent_identity_signature` recorded?** If no, the record is anonymous and cannot be attributed. The instance must reject the write or mark it `UNATTRIBUTED`.
  3. **Is the `authorization_receipt_hash` present and valid for this layer?** If no, the write is unauthorized. The instance must reject it.
  4. **Conversely, when can an agent write to shared memory without decision provenance?** Only when the layer is explicitly configured as `UNATTRIBUTED_LOG` (e.g., a public bulletin board), and downstream consumers are notified that records cannot be attributed or trusted.

Operational Effect

  1. **Poisoning Containment:** Enables the system to identify and quarantine poisoned records by tracing back to the responsible agent.
  2. **Authorization Enforcement:** Prevents agents from writing to layers outside their authorized scope, closing a critical security gap.
  3. **Post-Hoc Forensics:** Provides a complete reconstruction of the decision context, enabling debugging and root cause analysis of downstream failures.
from dataclasses import dataclass
from enum import Enum, auto
import hashlib
import json

class WriteProvenanceVerdict(Enum):
    ATTRIBUTED_AUTHORIZED = auto()
    MISSING_ATTRIBUTION = auto()
    UNAUTHORIZED_WRITE = auto()
    UNAPPROVED_MISSING_CHAIN = auto()

@dataclass(frozen=True)
class SharedWriteDecision:
    record_hash: str
    writer_agent_identity_signature: str | None
    authorization_receipt_hash: str | None
    decision_context_hash: str | None
    approval_chain_signatures: tuple[str, ...]
    target_layer_id: str

@dataclass(frozen=True)
class SharedLayerPolicy:
    authorized_agents: frozenset[str]
    requires_approval_chain: bool
    layer_id: str

@dataclass(frozen=True)
class WriteProvenanceManifest:
    verdict: WriteProvenanceVerdict
    directive: str
    manifest_digest: str

class SharedWriteProvenanceGuard:
    @staticmethod
    def _hash(data: str) -> str:
        return hashlib.sha256(data.encode("utf-8")).hexdigest()

    @classmethod
    def evaluate_write(
        cls, decision: SharedWriteDecision, policy: SharedLayerPolicy
    ) -> WriteProvenanceManifest:
        
        # Gate 1: Layer match
        if decision.target_layer_id != policy.layer_id:
            return WriteProvenanceManifest(
                verdict=WriteProvenanceVerdict.UNAUTHORIZED_WRITE,
                directive=f"HALT: Target layer {decision.target_layer_id} does not match policy layer {policy.layer_id}.",
                manifest_digest=cls._hash(f"LAYER_MISMATCH:{decision.record_hash}")
            )

        # Gate 2: Identity signature
        if not decision.writer_agent_identity_signature:
            return WriteProvenanceManifest(
                verdict=WriteProvenanceVerdict.MISSING_ATTRIBUTION,
                directive="HALT: Writer identity signature missing. Record cannot be attributed.",
                manifest_digest=cls._hash(f"NO_IDENTITY:{decision.record_hash}")
            )

        # Gate 3: Authorization
        if not decision.authorization_receipt_hash:
            return WriteProvenanceManifest(
                verdict=WriteProvenanceVerdict.UNAUTHORIZED_WRITE,
                directive="HALT: Authorization receipt missing. Write is unauthorized.",
                manifest_digest=cls._hash(f"NO_AUTH:{decision.record_hash}")
            )

        # Gate 4: Approval chain
        if policy.requires_approval_chain and not decision.approval_chain_signatures:
            return WriteProvenanceManifest(
                verdict=WriteProvenanceVerdict.UNAPPROVED_MISSING_CHAIN,
                directive="HALT: Approval chain required but missing.",
                manifest_digest=cls._hash(f"NO_CHAIN:{decision.record_hash}")
            )

        # Gate 5: Attributed
        digest = cls._hash(json.dumps({
            "record": decision.record_hash,
            "writer": decision.writer_agent_identity_signature,
            "layer": decision.target_layer_id,
            "approvals": str(len(decision.approval_chain_signatures))
        }, sort_keys=True))
        
        return WriteProvenanceManifest(
            verdict=WriteProvenanceVerdict.ATTRIBUTED_AUTHORIZED,
            directive="PROCEED: Write attributed, authorized, and (if required) approved.",
            manifest_digest=digest
        )