The Operational Memory Contract: Why Retrieval Is Not Authority in Self-Storage AI

Method and evidence boundary: This is Jared Mastroianni's authored proposed method. Harbor Annex and every facility, record, source state, entitlement, query, action, test, and result in the examples are fictional. Retrieval, citation, provenance, schema conformance, or a current-looking record does not establish factual authority, accuracy, completeness, entitlement, safety, compliance, performance, or outcome.

A retrieval system can find the right sentence and still support the wrong action.

That is the central design problem for AI-assisted self-storage operations. The model may retrieve a facility page that names gate hours, a policy document that describes after-hours access, a vendor record for the gate controller, and a manager note about a temporary exception. Every passage may be authentic. Every passage may also have a different scope, effective time, audience, and authority.

Putting those passages into a prompt does not reconcile them. It only makes them available to a model.

Retrieval-augmented generation is useful because it connects generation to external information. The original 2020 NeurIPS paper describes a model architecture combining parametric and non-parametric memory for knowledge-intensive tasks. That research does not define an operating control for a storage facility. A facility operator still has to decide which content is admissible, which source governs each fact, which version was effective, who may see it, what question it may answer, and whether the result may inform or authorize work.

This paper proposes an operational memory contract for that purpose. It is a self-storage-specific method for governing the material an AI system may retrieve and the evidence packet it must return. The contract is not a model, vector database, product specification, legal rule, security certification, or claim of deployment. It is an authored design method for keeping retrieval useful without confusing relevance with authority.

Open the full-size accessible diagram.

Governed companion package

Inspect the admission register and acceptance tests.

These exact files contain an authored method and fictional or blank-contract examples. They do not establish factual authority, source accuracy, entitlement, product deployment, customer use, performance, safety, compliance, certification, or independent validation.

Download the source and limitations register ↓Download the memory-admission register ↓Download the acceptance-test suite ↓Download the accessible operational-memory SVG ↓Download the operational-memory PNG ↓

Operational memory is not a folder of documents

Most organizations already have several kinds of memory:

• an archive preserves records;
• a search index helps people find material;
• a system of record governs a particular transaction or field;
• a reporting store supports analysis;
• a knowledge base organizes reusable information;
• a model retains patterns in parameters;
• a retrieval index selects passages for a query.

These are not interchangeable.

An archive can preserve a superseded policy correctly. A search engine can rank an old page highly. A data warehouse can retain a historical facility name for accurate period reporting. A model can reproduce language learned before a policy changed. None of those behaviors establishes what an operator should treat as current and governing at 9:00 a.m. today.

Operational memory is the governed layer that answers a narrower question:

Which approved assertions may be presented, to which actor, for which purpose, about which entity, as of which time, with what source and limitation?

That definition deliberately uses assertions, not documents. One document can contain several claims with different owners and effective periods. A facility page may govern public address and office hours while saying nothing authoritative about legal ownership, rentable square footage, gate programming, or current vendor responsibility. A lease, alarm report, policy, work order, invoice, and customer message may all mention the same facility while governing different facts.

The unit of operational memory therefore needs to be small enough to carry an explicit scope and large enough to preserve context.

Relevance is only the first gate

Vector similarity answers something like: Which stored passages are close to this query in the embedding space?

An operator needs several additional answers:

1. Does the passage describe the correct facility, asset, unit, person, policy, or event?
2. Is the source allowed to govern the fact being asked about?
3. Was the assertion effective at the requested time?
4. Is the requesting actor permitted to see and use it?
5. Is the content approved for this purpose?
6. Has it been superseded, revoked, quarantined, or challenged?
7. Can the system cite the exact source version and passage?
8. Does another admitted source conflict with it?
9. Is the answer informative, recommendatory, or eligible to enter an authorization workflow?
10. What must happen when one of those answers is unknown?

A high similarity score cannot answer those questions. Neither can a model confidence score.

This is why a retrieval pipeline needs two different kinds of filtering. Semantic retrieval finds material that may be relevant. Operational admission determines whether that material may be used for the specific request. The order matters: entitlement and purpose filters should constrain the candidate set before sensitive content reaches generation, while authority, time, conflict, and consequence gates should continue through evidence assembly and response review.

The twelve-field memory contract

Every admitted memory item should carry at least twelve fields. The exact schema can vary, but the distinctions should survive implementation.

1. Memory item identity

Assign an immutable identifier to the admitted assertion or passage. Do not use a filename or vector position as the only identity. Files move, chunks change, and indexes are rebuilt.

2. Subject identity

Name the facility, asset, zone, unit, policy, vendor record, event, work item, or other entity the assertion describes. Use the governed entity identifier, not only the source system's label.

3. Claim type and scope

State the fact the source is allowed to support: public address, office hours, access hours, equipment model, invoice amount, work status, policy condition, or another defined type. “Facility data” is not a scope.

4. Source authority

Record the source owner and the precise authority it has for that claim type. A public facility page may govern public-facing hours. A controller log may be evidence of a gate event. A technician note may describe observed condition. None should inherit authority for the others' fields.

5. Effective time

Record when the assertion became and ceased to be applicable in the real operation. Effective time is different from upload time, modification time, observation time, and retrieval time.

6. Observation and ingestion time

Preserve when the fact was observed, when the source version was captured, and when it entered the memory pipeline. These timestamps make staleness and pipeline lag visible.

7. Audience and entitlement

Classify who may retrieve the content. Public, portfolio, facility, regional, finance, people, security, legal, restricted, and synthetic are examples—not a universal taxonomy. Authorization must be evaluated for the requesting actor and task, not inferred from access to the chat interface.

8. Allowed purpose

Specify what the item may support: answer a public-hours question, prepare a maintenance briefing, reconcile a work order, draft an internal summary, or test a fictional workflow. Content admitted for one purpose should not silently migrate to another.

9. Provenance and transformation

Retain the source URI or record key, captured version, checksum where appropriate, extraction method, chunking rule, transformation history, and responsible agent. W3C PROV-O offers general Entity, Activity, and Agent concepts for representing lineage. It does not determine operational authority by itself.

10. Supersession and challenge state

Link revisions, withdrawals, corrections, and unresolved conflicts. Never overwrite the prior assertion without preserving why it stopped governing. A challenged item can remain visible for investigation without remaining eligible for routine answers.

11. Citation address

Preserve a stable way to recover the exact source and passage presented to the model. A generic link to a 90-page manual is not enough when the answer depends on one paragraph from one version.

12. Consequence class

Name the maximum use permitted for the item: informational, draft-only, recommendation support, human-review required, or prohibited from action. A retrieved assertion should not grant itself authority to trigger a gate command, customer communication, vendor dispatch, financial posting, public correction, access change, or legal conclusion.

A lifecycle for memory, not a binary upload

“Indexed” is not a sufficient state. A practical memory lifecycle separates at least seven states:

1. Candidate — discovered or submitted, not yet trusted.
2. Quarantined — isolated for malware, prompt injection, hidden content, source, rights, privacy, or integrity review.
3. Admitted — approved for named audiences, purposes, claim types, and time bounds.
4. Active — currently eligible under those constraints.
5. Challenged — a conflict or possible defect is under review; routine use is restricted.
6. Superseded — preserved for lineage or historical questions but not presented as current.
7. Revoked — withdrawn from use because authority, rights, integrity, privacy, or safety conditions failed.

Deletion and retention remain separate decisions. A revoked item may need to be retained as evidence, or it may need to be securely deleted. The operational state alone does not answer that question.

The 2025 joint AI data-security guidance authored by NSA, CISA, FBI, and international partners emphasizes provenance, integrity, access controls, secure storage, supply-chain risk, maliciously modified data, and data drift across the AI lifecycle. It is broad security guidance, not a self-storage implementation standard. Its useful design implication here is that corpus governance begins before embedding and continues after deployment.

The query needs a contract too

The corpus cannot make a query safe if the request has no operating context.

A query packet should carry:

• requesting actor and current role;
• facility, asset, portfolio, customer, policy, or event scope;
• stated purpose;
• as-of time;
• permitted data classes;
• consequence class;
• required source types;
• conflict behavior;
• freshness threshold;
• abstention and escalation route.

“What are the gate hours?” is incomplete. The system needs to know which facility, whether the question concerns public posted hours or programmed controller state, whether the answer is for a customer draft or an internal diagnostic, and what date the user means.

The model should not invent those missing qualifiers from conversation tone. It should ask, restrict, or stop according to the declared rule.

The response should be an evidence packet

The output of operational retrieval should be more than prose. A minimum response packet contains:

• normalized question and scope;
• answer or explicit abstention;
• subject identifier;
• as-of time;
• exact cited assertions;
• source owner and captured version;
• effective periods;
• access and purpose decision;
• conflicts and excluded sources;
• missing facts;
• consequence classification;
• next required human or system action;
• retrieval, model, prompt, policy, and memory-index versions.

This packet makes an important separation visible: a system can have enough evidence to explain a condition without having authority to change it.

NIST's Generative AI Profile suggests reviewing and verifying sources and citations, verifying that retrieval data is grounded, documenting retrieval approaches, and reassessing risk after retrieval-augmented generation is introduced. The profile is voluntary and cross-sectoral. It does not declare that cited output is correct or authorize any facility action.

A fictional access-hours conflict

Consider a fictional facility called Harbor Annex.

The retrieval corpus contains four authentic items:

1. A public facility page captured August 1 says gate access is 6:00 a.m. to 10:00 p.m.
2. A controller configuration export captured August 18 shows a 6:00 a.m. to 9:00 p.m. schedule.
3. A manager memo effective August 20 authorizes a temporary 24-hour access exception for one approved contractor through August 23.
4. A year-old marketing brochure says “access anytime.”

A tenant asks, “Can I enter at 11 tonight?”

All four items are relevant to access. None can be combined by majority vote.

The brochure is superseded and not authoritative for current access. The temporary memo applies to one contractor, not tenants. The controller export describes programmed state but may not govern what was publicly promised. The public page governs the current public statement but conflicts with the controller state.

The correct response is not a confident yes or no. The evidence packet should say that the current public statement ends access at 10:00 p.m., the observed controller configuration ends at 9:00 p.m., the 24-hour exception does not apply to the tenant, and an unresolved one-hour conflict requires facility confirmation before promising entry.

For an internal operator asking why a tenant was denied at 9:35 p.m., the same corpus produces a different permitted answer: it can explain the public-versus-programmed mismatch and open a reconciliation item. It still cannot modify the controller or send a customer notice without the required authorization path.

That is the operational memory contract working. The model is useful precisely because it does not collapse four authentic sources into one invented fact.

Six stop conditions

An AI-assisted facility workflow should stop or abstain when:

1. the subject cannot be resolved to a governed identity;
2. no admitted source has authority for the requested claim type;
3. the required effective time is missing or outside the admitted interval;
4. the requesting actor or purpose is not entitled to the retrieved content;
5. governing sources conflict and the use case does not define a safe conflict policy;
6. the requested consequence exceeds the maximum permitted use of the evidence.

Other controls may add more stop conditions. These six define a useful minimum because each protects a different boundary: identity, authority, time, access, reconciliation, and consequence.

Evaluation must test the memory system, not just the model

A polished answer is not the acceptance criterion.

Build an evaluation set from approved, synthetic, or carefully de-identified scenarios. Include ordinary questions, adversarial items, stale sources, conflicting sources, missing qualifiers, entitlement changes, temporary exceptions, corrected identities, and requests that should stop.

Measure at least:

• authority precision — how often cited assertions are authorized for the claim type;
• temporal correctness — whether the answer uses the version effective at the requested time;
• entitlement enforcement — whether restricted items are excluded before generation;
• citation fidelity — whether each material answer statement is supported by the cited passage;
• conflict surfacing — whether admitted disagreements are exposed rather than averaged away;
• abstention quality — whether the system stops when a required identity, source, time, entitlement, or authority is missing;
• supersession behavior — whether historical material is preserved without appearing current;
• poisoning resistance — whether hidden instructions, unverified uploads, and unauthorized revisions remain quarantined;
• change sensitivity — whether corpus, policy, identity, permission, embedding, retrieval, or model changes trigger appropriate retesting;
• action containment — whether an informative answer remains unable to execute higher-consequence work without a separate authorization.

Do not compress those measures into one accuracy percentage. A system can score well on ordinary questions and still fail every access-control test. Report the test population, versions, pass criteria, exceptions, and unmeasured risks.

OWASP's 2025 vector and embedding guidance highlights unauthorized access, cross-context leakage, knowledge conflict, embedding inversion, data poisoning, source validation, classification, partitioning, and retrieval logging. It is community security guidance and not a certification. It is especially useful as a reminder that a vector store is a security boundary, not merely a search component.

The architecture boundary

A production design will vary, but the responsibilities should remain legible:

1. Source connectors capture approved content and source metadata.
2. Quarantine isolates new or changed material before routine retrieval.
3. Admission service applies source, rights, integrity, privacy, scope, time, and purpose rules.
4. Versioned assertion store preserves approved items and their supersession graph.
5. Entitlement filter constrains the candidate corpus before semantic retrieval.
6. Retriever selects potentially relevant assertions.
7. Evidence assembler applies authority, time, conflict, and citation rules.
8. Generator produces bounded language from the eligible evidence packet.
9. Policy gate classifies consequence and decides answer, ask, review, or stop.
10. Human review handles designated uncertainty and consequence classes.
11. Action connector accepts only a separately authorized decision packet.
12. Readback and provenance preserve what was requested, executed, observed, and reconciled.

The generator is one component in this sequence. It does not own corpus admission, user entitlement, source authority, policy, authorization, execution, or verification.

NIST SP 800-53 Rev. 5.1 provides a current general catalog of security and privacy control families including access control, audit and accountability, configuration management, system and information integrity, and supply-chain risk management. Those controls can inform implementation. They do not make this proposed architecture compliant, complete, or appropriate for a particular organization.

The companion package includes an accessible architecture diagram, a PNG rendering, a 32-test operator-to-architect acceptance suite, and a fictional admission-register template. The sample identifiers, records, checksums, sources, and events are teaching data only.

Beginner-to-architect implementation ladder

Beginner: govern one answer

Pick one recurring low-consequence question, such as public office hours. Name the governing page, facility identity, owner, review date, and fallback. Require the answer to cite the exact page. Do not ingest private material.

Intermediate: build the admission register

List each source, claim scope, effective period, audience, purpose, owner, review trigger, and supersession rule. Add explicit candidate, quarantined, active, challenged, superseded, and revoked states.

Advanced: separate retrieval from authority

Apply entitlement before retrieval. Build the evidence packet. Test conflicting and stale sources. Introduce an explicit abstention route. Keep the action connector disconnected until the information boundary is reliable.

Architect: version and evaluate the full contract

Version the corpus snapshot, assertions, source captures, chunking, embeddings, retrieval policy, prompts, models, identity mapping, entitlement rules, evaluation set, and consequence policy. Run regression tests after each material change. Preserve the ability to reconstruct why a source was admitted and why a response was allowed.

A 30-minute operator exercise

Choose one question that staff answer from memory today.

For example: “Is this unit eligible for after-hours access?”

In the first ten minutes, list every source someone might consult. In the second ten minutes, assign each source a claim scope, owner, effective time, audience, and purpose. In the final ten minutes, write three conditions under which the answer must stop.

If the team cannot name the governing source, do not solve the problem by adding more documents to a chatbot. First resolve the operating contract.

What the contract does not solve

An operational memory contract does not make a weak source accurate. It does not determine legal rights, create consent, satisfy privacy or security obligations, repair a broken identity register, define customer policy, validate a vendor claim, or prove an AI system trustworthy.

It also does not eliminate model limitations. A model may still misread a passage, omit a conflict, generate unsupported text, or behave differently after a change. That is why citations, structured evidence, consequence gates, tests, monitoring, human review, and reconciliation remain necessary.

The method should be adapted through security, privacy, legal, operational, records, and technical review appropriate to the specific use case. Sensitive facility, customer, employee, security, access, financial, and contractual material should not be placed in a retrieval system merely because the system can store it.

Retrieval becomes useful when its limits are operational

Self-storage operators do not need an AI system that remembers everything. They need one that can show what it is allowed to use, what the source actually governs, when the assertion applies, who may see it, where sources disagree, and when the system must stop.

The design principle is simple:

Retrieval supplies candidate evidence. Authority comes from the operating system around it.

When that distinction is preserved, AI can help a manager find the right record, compare current and historical assertions, surface a conflict, prepare a review packet, and explain why an action is blocked. When the distinction is erased, the organization has not created operational memory. It has created a faster way to make an old, unauthorized, or cross-context statement sound certain.

This is a proposed educational method authored by Jared Mastroianni. The example is fictional. The paper does not establish product capability, deployment, customer use, performance, savings, legal or security sufficiency, compliance, certification, industry adoption, publication, indexing, coverage, recognition, endorsement, or expert-status outcome.

Primary sources

• Patrick Lewis et al., “Retrieval-Augmented Generation for Knowledge-Intensive NLP Tasks,” NeurIPS 2020: https://proceedings.nips.cc/paper/2020/hash/6b493230205f780e1bc26945df7481e5-Abstract.html
• NIST, Artificial Intelligence Risk Management Framework 1.0, January 26, 2023: https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-ai-rmf-10
• NIST, Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile, NIST AI 600-1, July 2024: https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf
• NSA, CISA, FBI, ASD's ACSC, NCSC-NZ, and NCSC-UK, AI Data Security: Best Practices for Securing Data Used to Train & Operate AI Systems, May 2025: https://www.cyber.gov.au/sites/default/files/2025-05/CSI_AI_Data_Security.pdf
• OWASP GenAI Security Project, LLM08:2025 Vector and Embedding Weaknesses: https://genai.owasp.org/llmrisk/llm082025-vector-and-embedding-weaknesses/
• W3C, PROV-O: The PROV Ontology, Recommendation, April 30, 2013: https://www.w3.org/TR/2013/REC-prov-o-20130430/
• NIST, SP 800-53 Rev. 5.1 Security and Privacy Controls for Information Systems and Organizations: https://csrc.nist.gov/Projects/risk-management/sp800-53-controls/downloads