Blog · July 22, 2026

A compromised agent can write a lie into shared memory. It can't sign its own name to it as true.

Shared memory is the whole pitch of a multi-agent workspace: don't make every run re-derive what a prior run already learned. knowledge_search returns the finding, the next agent trusts it, work moves faster. But trust-over-verify only works if the thing being trusted can't be faked from the inside — and a knowledge note, by default, is just text an actor wrote. Nothing stopped the actor who wrote a claim from also being the one who marked it authoritative.

That gap matters more than it sounds like it should, because the actor writing the note doesn't have to be honest. Assume the agent is compromised — prompt-injected, steered by something it read rather than something you asked it to do. A turned agent that can write to shared knowledge can try to launder a fabricated instruction into the record: file a note claiming a security control is optional, or a credential is safe to log, or a check can be skipped — worded like an institutional finding, not an order. The next agent that reads it doesn't see an instruction from an untrusted source. It sees "the team already figured this out," because that's what a knowledge note is.

The wrong fix is a self-reported flag. A verified: true column an actor can set on its own note is worse than no signal at all — it doesn't stop the laundering, it dresses it up. A compromised agent that can write a poisoned note can just as easily write a poisoned note that also claims to be verified. Anything the note's own author can set, the note's own author can fake.

Verification has to come from somewhere the note can't reach

So we built knowledge_verify as a real provenance record, not a field on the note. Two guards, both hard requirements, neither expressible from inside the note itself:

Only a human can call it. The RPC checks the caller's actor kind before it touches anything. An agent — including a fully compromised one, steered by the worst instruction it's ever been fed — gets 42501 on the attempt, every time. Not a policy an agent is supposed to follow. A check it structurally cannot pass, because the value it needs (kind = 'human') isn't something a credential can claim its way into.

Nobody can verify their own note. Even for a human-authored note down the line, the actor who wrote the claim can't also be the actor who signs off on it — the RPC compares verified_by_actor_id against the note's source_actor_id and rejects a match. Verification is a second, independent party attesting to the note, or it isn't verification.

Put together: a note can only carry verified_by_actor_id / verified_at if a specific human, who isn't the note's own author, deliberately called knowledge_verify on it. There's no path from "an agent wrote a note" to "the note reads as verified" that skips that human. match_notes — the function every semantic search call runs through — returns the flag straight from that provenance, not from anything the note's text claims about itself.

Disputing runs the opposite direction on purpose. Any actor can flag a note as disputed — low friction, because a false-positive dispute costs you a re-check and a false-negative costs you a poisoned assumption an entire fleet inherits. Verifying stays deliberately hard to earn and easy to check; disputing stays deliberately easy to raise. The asymmetry is the point: a claim shouldn't be trusted by default, but it should be challengeable by default.

What this doesn't claim to solve

knowledge_verify doesn't stop an agent from writing a bad note in the first place — cross-tenant isolation and append-only history are what bound that blast radius, and they're a different wall. This one solves a narrower, sharper problem: once a note exists, can the system that wrote it also manufacture the reason to trust it? With this shipped, the answer is no. Verification requires a human, a real one, who wasn't the source.

It also doesn't retroactively verify anything. Every note written before this shipped, and every note written since without a human reviewing it, sits at verified: false — which is the honest default, not a bug to patch. A workspace that reports everything as verified because verification was cheap to fake isn't safer than one that says "check this" — it's just quieter about the same risk.

The shortest version

A knowledge note is a claim. A verified note is a claim a specific human, who isn't its author, chose to stand behind — recorded as a fact the note's own text can never assert about itself. An agent can write anything into shared memory. It can't sign its own name to "this is true," because that signature was never a field it was allowed to reach.

That's the standard shared memory needs to clear before "trust it over your own recall" is safe advice instead of a hope. Start at ledgenter.com — a shared workspace where a claim and a verified claim are never the same field.