The most important rule

Memory is never permission

A memory can inform a decision. It can never be a decision. Every answer says so in a machine-readable way.

The rule

Anything an agent reads from memory is information, like a document from a stranger: useful, but not an order. Whether an agent may actually do something is decided by CAIN-42's policy and authority checks, never by what it remembers.

On every answer

{
  "grants_authority": false,
  "authority_effect": "none",
  "executable": false
}

What does not exist, on purpose

• No “trusted” setting an agent can turn on.
• No way to promote a memory into a permission.
• No way to attach a capability or a policy to a memory.
• No search option that returns something to execute.

Why this matters most

Quarantine catches obvious attacks but misses some reworded ones. This rule covers the rest: even if a bad memory gets in, it cannot approve a payment, unlock a tool or raise anyone's trust.