Structured retrieval
Agents read governed entities and semantic measures rather than raw tables or copied formulas.
Pillar 05 · AI Factory
Decide before an effect exists.
The AI Factory separates context from authority and proposals from effects. Retrieval states what may be treated as current. Policy—not a prompt—decides which tools may act.
ContextStructured · graph · text
AuthorityGrants + policy
EvidenceDecision before action
Hard rule
The model cannot grant itself authority.
Non-negotiable
An action is never taken until deterministic policy says it may. The model, context, proposed arguments and verdict are recorded before execution.
Runtime identity can only narrow an agent declaration. Approval is a fresh, scoped authority with expiry—not an explanation shown after the effect.
Runtime boundary
Retrieval, reasoning and action are different control problems.
Combining them behind one chat interface does not make their authorities equivalent.
Graph retrieval
Relationships and traversal constraints are explicit, versioned and subject to the same identity boundary.
Text authority
Each corpus declares the topics it may answer for. Supersession removes obsolete material from retrieval eligibility.
Tool grants
The effective tool set is the intersection of declaration, runtime identity, policy and current approval.
Action gate
Policy fails closed. Idempotency, expiry and argument constraints are checked before a side effect.
Memory
Conversation and operational memory are purpose-scoped, retained deliberately and never treated as new authority.
Action lifecycle
Make the decision reconstructable.
The audit must answer what the agent knew, which model and declaration ran, what it proposed, which policy evaluated it, who approved it and what effect followed.
Retrieve
Resolve governed structured data and currently authoritative knowledge.
Propose
Create typed tool intent and arguments within the declaration.
Evaluate
Intersect identity, tool grant, data policy and action constraints.
Approve
Obtain fresh human authority when the policy requires it.
Record
Persist model, context, proposal and verdict before execution.
Execute
Apply one idempotent, bounded effect and attach the observed outcome.
Prompt-injection boundary
Treat untrusted content as data.
Instruction text cannot reliably distinguish a legitimate direction from malicious content embedded in a document or tool response. The safety boundary therefore lives outside the model: retrieval authority, grants, schemas, deterministic policy, approval and effect isolation.
- Can a corpus supersession remove an obsolete document from retrieval?
- Can retrieved text be shown failing to expand tool authority?
- Does the action gate fail closed when policy or approval is unavailable?
- Can approval expiry and argument substitution be rejected?
- Can duplicate execution be proven to produce one bounded effect?
- Can an evaluator reconstruct the decision before reading runtime logs?
Limitation
Prompt injection cannot be eliminated by instruction text. Consequential action requires deterministic authority outside the model, explicit isolation and acceptance proportional to impact.
Technical evaluation