The Instruction Survived. Its Provenance Did Not.

AI memory creates value because information can survive beyond the interaction in which it first appeared.

That same persistence creates a governance problem: what happens when the information survives but the system forgets why it should not have trusted it?

Security research disclosed in August 2026 against NVIDIA NemoClaw configurations provides a concrete example. Researchers demonstrated that a malicious web page could exploit a network configuration, reach the local Ollama service, alter model configuration, and place hidden instructions into the model's chat template. Those instructions could then persist into later conversations—even when the legitimate agent supplied its own system prompt.

The original interaction ended. The instruction remained.

Its provenance did not remain equally visible.

Persistence Changes the Nature of Prompt Injection

Traditional prompt injection is often understood as a current-session conflict: untrusted content attempts to influence the model while the model is processing it.

Persistent poisoning is different. The hostile content crosses from a temporary Source into a durable Record or configuration. Later, that durable state becomes part of the system's trusted Context.

The risk therefore survives beyond the source event.

In continuity terms, the path becomes:

Untrusted Source → Record → Institutional or Agent Memory → Future Reuse → Context → Decision → Action.

If the system preserves the instruction but not the trust status and authority limitations of its source, persistence effectively inflates authority over time.

Memory Does Not Become Trustworthy by Aging

Human institutions already know this problem. An old memorandum can remain in a shared drive after the policy that governed it has been superseded. A lesson learned can become detached from the unusual circumstances in which it applied. An employee can remember a workaround while forgetting why it was once necessary.

AI memory accelerates the same risk because remembered content can be incorporated automatically into future reasoning.

The mere fact that information is persistent does not establish that it was verified. Repeated retrieval does not establish authority. Successful reuse does not prove that the original source was legitimate.

A continuity-aware memory system must therefore preserve not only content, but the conditions governing the content: source identity, trust classification, evidence state, authority, time, scope, conflicts, corrections, and supersession.

Provenance Has to Survive the Transformation Into Memory

This is the critical relationship.

When information enters memory, it is transformed. It may be summarized, embedded, consolidated, rewritten, indexed, merged with other memories, or converted into configuration. Each transformation creates an opportunity for the source relationship to weaken.

If a low-trust external observation becomes an ordinary memory item without retaining its provenance, the system can later treat it like first-party history. A temporary adversarial instruction can become indistinguishable from a durable preference or governing rule.

That is provenance decay.

The institutional problem is not that the system forgot the information. It remembered too little about the information.

Future Reuse Requires Requalification

GovKM's Continuity Topology ends in Institutional Memory → Future Reuse for a reason. Reuse is not automatically legitimate because knowledge was preserved.

Before remembered information influences a new consequential action, the system should be able to recover whether the source was trusted, whether the memory was verified, whether authority has changed, whether the context still applies, whether the memory conflicts with newer information, and whether its permitted purpose includes the proposed use.

That is especially important for agents with tools. A poisoned memory that changes an answer is serious. A poisoned memory that changes a file, sends information, modifies infrastructure, or invokes another system turns memory quality into operational authority.

AI Memory Needs Authority Lineage

Current discussion of agent memory often focuses on storage capacity, retrieval quality, consolidation, and relevance. Those capabilities determine whether the system remembers.

Continuity asks a different question: can the system determine what the remembered item is allowed to influence?

A durable memory object should not acquire more authority than the source from which it originated. If the source was untrusted, that limitation must persist. If the source was later validated, the validation should be recorded. If the information is superseded, its future use should change accordingly.

This makes provenance an active governance property rather than a historical citation.

The GovKM Proposition

NemoClaw's disclosed vulnerability is a cybersecurity example, but the continuity principle applies far more broadly.

Organizations are building AI systems that remember conversations, retrieve prior work, consolidate experience, and carry knowledge across long-running workflows. Those systems will accumulate information from users, documents, web pages, tools, other agents, and institutional records with very different levels of authority.

Persistent memory requires persistent lineage.

If content can survive into future reasoning, the source's trust, authority, lifecycle, and context must survive with it. Otherwise the system can remember the instruction while forgetting the institutional conditions that should have prevented the instruction from governing anything at all.