Bind the exact request.
Protected requests bind certificate identity, method, path, body, nonce, and timestamp.
Security belongs inside memory.
A filter after retrieval is too late. AIMOS composes authority, origin, provenance, retention, disclosure, mutation, and evidence into the operations that create and use memory.
Trust boundaries
The request does not
declare its own authority.
Verified evidence—not a caller field, environment variable, or model statement—determines what the runtime will accept.
Derive where input came from.
The server commits origin and classification from verified ingress and retained action evidence.
Keep the evidence, govern the disclosure.
Potentially poisoned content remains retained with a reversible label while recall policy keeps it out of active context.
Change retrieval weight without changing history.
Authorized, bounded transitions bind prior state, new state, signer epoch, provenance, and predecessor continuity.
Canary controls
Follow marked content
across boundaries.
Canary detects its explicit marker family. It is a traversal control—not a claim to detect every unmarked poisoning attack.
Persisted
Marked memory remains under retained quarantine.
Relayed
Marked content is excluded from downstream context.
Executed
Tool input is inspected before consequential action.
Exposed
Tool output is checked before it can re-enter context.
Recorded
The traversal outcome remains part of the evidence history.
Bounded
Explicit scope prevents an honest control from becoming a universal claim.
Failure model
What should break
before trust does.
Rejected, failed, and denied operations retain non-success evidence and cannot return a successful terminal.
Reject the mutation.
Invalid authority does not reach a canonical state transition.
Restrict the disclosure.
Origin and epistemic evidence participate before context is released.
Keep the failure visible.
A failed operation retains its terminal evidence instead of disappearing behind a generic error.
02
Security claims stay bounded
Strong cryptography does not turn false information into truth.
The central distinction is integrity, not omniscience. AIMOS can prove that an authorized identity asserted a specific memory at a particular ledger position. It cannot prove the assertion was factually correct.
Read the threat modelSecurity is inspectable