Useful memory needs boundaries.
Durable memory is only worth having if it's governed. AIOS is built around project isolation, fail-closed authorization, and the smallest amount of administrative authority that gets the job done — not around absolute security guarantees, which no system should claim.
Project isolation
Each project is a distinct boundary. A request scoped to one project cannot casually pull in another's knowledge.
Fail-closed authorization
When routing or authorization is ambiguous, the system declines or escalates rather than guessing in the direction of access.
Least necessary authority
Administrative capabilities exposed to any client are narrow and specific — not arbitrary infrastructure control.
Secrets are not memory
Credentials, tokens, and similar secrets are treated as operational material, not as content that belongs in durable project knowledge.
Governed automation
Automated or agentic actions against durable knowledge go through the same authorization and policy checks as a direct request — automation isn't a shortcut around governance.
Connectivity ≠ authorization
A client being able to reach the gateway doesn't mean it can read or write everything. Read and write permissions are tracked as distinct, per-project facts.
A memory write is a decision pipeline
Conversation alone doesn't automatically become durable memory. Every candidate item moves through the same evaluation before anything is written.
Screen
Honor remember/temporary signals; block secrets and disallowed data outright.
Route
Resolve the owning project the item actually belongs to.
Classify
Assign a record type and check whether the subject already exists.
Assess
Weigh significance, confidence, duplication, and correction status.
Choose
Select the least destructive fit: ignore, create, update, correct, escalate, or block.
Authorize
Apply project policy before any write is permitted to proceed.
Verify
Confirm project, target, and content match what was actually intended.
ROUTINE & LOW RISK
Create, categorize, or append compatible facts when policy permits.
SCOPED & REVERSIBLE
Correct or merge only with an exact target and preserved history.
EXPLICIT AUTHORIZATION
Deletion, bulk rewrite, or a governance change requires it directly.
This pipeline and its risk tiers are illustrative of the governance principle, not a literal log of any real system's internal states.
Not everything that's said becomes durable
Pick an example below to see how a conversational item moves through that pipeline — before it becomes Ignore, Create, Update, Correct, Escalate, or Block.
"Oak cabinets might look nice, who knows."
Temporary small talk, not a decision.Is it meant to last?
No — it reads as an offhand remark, not a commitment."We're going with the oak shaker cabinets from Supplier B."
A stated decision.Is it useful, tied to the right project, and allowed data?
Yes to all three — it's a real decision, about the kitchen project, containing nothing sensitive.Is this a new subject?
Yes — no prior cabinet decision exists yet."Actually, the countertop quote was $2,100, not $1,800 like we noted."
A correction to existing durable state.Does this subject already exist in the project?
Yes — a countertop cost estimate is already on record.Right project, allowed data, safe action?
Yes to all three."Let's push the launch back two weeks."
Could plausibly belong to more than one active project.Is the correct project clear?
No — routing can't determine this with confidence from the request alone.What happens under ambiguity?
The system fails closed rather than guessing which project to update."Here's my bank login in case you need it."
Contains sensitive credential material.Is this allowed data for durable memory?
No — secrets and credentials are excluded from durable knowledge as a matter of policy.These are illustrative examples, not real conversations, real projects, or real customer data.
How does this hold up if something needs to be rebuilt?
Ownership & Recovery covers backup, reconstruction, and what "canonical" actually protects you against.