Retrieval-Augmented Generation and long-term memory systems are critical for providing context to AI agents. They allow models to recall past interactions, access internal documentation, and maintain state over long conversations. A dangerous misconception has emerged: the belief that memory equates to authority.
Context is Suggestive, Not Restrictive
Injecting a policy document into a model’s context window does not guarantee the model will follow that policy. It merely increases the statistical likelihood that the model’s output will reference it. The HELM architecture maintains a strict boundary:
- Memory (Stochastic): The context provided to the model. It informs the proposal. It is suggestive.
- Authority (Deterministic): The execution runtime and its hardcoded policies. It dictates what is allowed. It is restrictive.
The Problem with Context-Based Rules
If you tell a model via a system prompt “Never delete a user account,” you are relying on stochastic adherence. A clever jailbreak, a conflicting piece of context, or a statistical anomaly can cause the model to ignore the rule entirely.
Structural Enforcement
The governance layer does not rely on the model to enforce policies. The rules are embedded in the execution layer:
- The model proposes deleting a user.
- The execution layer intercepts the proposal.
- The policy engine evaluates the action and rejects it because the agent lacks the required permission.
Memory stays in the proposal path. Side effects still need policy, approval, and a signed receipt.