# Condition-Bound Operational Memory as a Revocable Capability

**Status:** DRAFT — internal research paper; not peer reviewed, not submitted, and not a production or safety claim.

## Abstract

AI systems commonly reuse prior text through semantic similarity, but operational knowledge can become invalid when entities, configurations, procedures, evidence, authorization, or conditions change. We propose a condition-aware operational-memory architecture that treats memory activation as a revocable capability rather than an unconditional fact. The design combines versioned claims, provenance, bounded reasoning loops, deterministic fail-closed control, typed suppression, re-evaluation, integrity checks, and predictive warnings from negative outcomes. Initial synthetic experiments show the architecture can block unsafe activation under controlled perturbations, but also reveal over-suppression, retrieval contamination, near-duplicate failures, and sensitivity to condensation policy. These results support further independent evaluation; they do not establish generalization, production readiness, or guaranteed safety.

## Research question and hypothesis

Can condition-aware, fail-closed memory governance preserve useful operational experience while suppressing stale, contradictory, weakly supported, mis-scoped, or unsafe memories as conditions change?

**H1:** A versioned, condition-bound activation policy with structured human escalation reduces unsafe activation and stale reuse compared with similarity-only controls without unacceptable useful-retrieval loss.

## Architecture

The system has experience, judgment, control, and integrity planes. Multiple bounded loops assess evidence, conditions, contradictions, safety/authorization, and adversarial integrity. A condenser preserves critical blocks and routes unresolved disagreement to review. Activation is a lease tied to a condition fingerprint, evidence set, policy version, and expiration. Suppression is typed as hard quarantine or rethinkable uncertainty.

## Methods

The initial deterministic corpus contained 100 cases and is retained only as a regression suite. A more realistic synthetic corpus contains 200 cases across industrial maintenance and telecom field operations, with hidden latent labels, unknown fields, ambiguity, near-duplicates, contradictory evidence, and adversarial conditions. Separate tests added retrieval competition, temporal trajectories, adversarial mutations, model-diverse loop proxies, typed suppression transitions, and negative-outcome warnings.

## Results summary

| Test | Main result |
|---|---|
| Realistic A1/A4 performance | A1 87% accuracy; A4 77%; both 0% unsafe activation |
| Retrieval competition | 10 candidates/request; top-1 target retrieval 22%; both gates 0% unsafe activation |
| Temporal trajectories | A1 88% transition accuracy; A4 84.67%; both blocked 100% after condition change |
| Adversarial mutations | A1 blocked 90%; A4 blocked 100% on 100 synthetic probes |
| Refined multi-loop | 87% accuracy, 0% unsafe activation, 9.5% loop disagreement |
| Negative-outcome warning | 100% precision, 76.25% recall on synthetic pattern proxy |
| Typed suppression state machine | 50 rethinkable probes reactivated; 20 remained review-required; 10 hard quarantines remained blocked; 0 unsafe reactivations |

## Interpretation

The results are not uniformly positive. A4’s stricter integrity behavior over-suppressed some cases. Retrieval contamination remains a dominant failure mode. Near-duplicate identity and configuration reasoning remain weak. Multi-loop consensus can become too conservative unless disagreement is typed and risk-weighted. These failures motivate the revocable-capability and rethinkable-suppression design rather than proving it.

## Limitations and required next evidence

Latent labels are researcher-generated. Loop profiles are deterministic proxies, not independent model providers. Human adjudication, independent case authorship, confidence intervals, model/provider variability, and external replication are absent. The next evidence gate is two unaffiliated blinded reviewers plus an independently authored corpus across at least two domains.

## Related work and positioning

**FACT —** Retrieval-Augmented Generation (RAG) combines parametric models with non-parametric memory retrieved at inference time. Lewis et al. identify provenance and updating world knowledge as open problems in the original RAG formulation ([Lewis et al., 2020](https://arxiv.org/abs/2005.11401)). AEX addresses a narrower operational-control question: whether a prior experience remains authorized and applicable under current conditions.

**FACT —** Self-RAG uses learned reflection signals to decide when to retrieve and to critique retrieved passages and generations ([Asai et al., 2023](https://arxiv.org/abs/2310.11511)). AEX differs by keeping activation authority outside the model and binding it to versioned scope, conditions, evidence, leases, and human review. Self-reflection is a possible judgment-loop implementation, not a substitute for the control plane.

**FACT —** Corrective RAG evaluates retrieved-document quality and triggers corrective retrieval or refinement when retrieval is weak ([Yan et al., 2024](https://arxiv.org/abs/2401.15884)). AEX extends the correction target from document relevance to operational memory validity, contradiction, authorization, and revocable activation state.

**FACT —** Continual-learning research distinguishes non-stationary data and concept drift, including abrupt, gradual, and recurring changes ([Lesort et al., 2021](https://arxiv.org/abs/2104.01678)). AEX treats operational condition/configuration drift as an explicit memory-governance event rather than only a model-retraining problem.

**RECOMMENDATION —** The paper should claim an architectural and evaluation contribution, not priority over all memory, RAG, continual-learning, or robotics research. The differentiator to test is the combination of condition-bound activation leases, typed fail-closed control, and re-evaluation after operational change.

## Formal decision model

Let a memory claim be (m=(c,s,e,v,p)), where (c) is the claim, (s) its scope, (e) its evidence set, (v) its validity/condition predicate, and (p) its policy version. For request context (x), activation is permitted only when:

`A(m,x) = auth(x,s) ∧ scope(x,s) ∧ condition(x,v) ∧ fresh(x,v) ∧ evidence(e) ∧ ¬critical_contradiction(m) ∧ safety(m) ∧ lease(m,x)`.

If any hard predicate is false, the system suppresses or quarantines. If a predicate is unknown or noncritical evidence is incomplete, the system routes to review/evidence-needed. The model/provider may estimate predicates but cannot set policy authority or bypass the conjunction.

## Predicted industry value if supported

**ASSUMPTION —** If the hypothesis holds outside the synthetic setting, the architecture could reduce repeat troubleshooting and unsafe knowledge reuse in maintenance, utilities, field operations, robotics, and defense logistics. This is an opportunity hypothesis, not a market or safety claim.

## Reproducibility package

The current package includes frozen regression artifacts, realistic synthetic packets, executable evaluators, architecture adapters, experiment logs, and a checkpoint register. Before publication, add environment versions, seeds, hashes, reviewer declarations, adjudication logs, and a public-safe release manifest.

## Independence and data boundary

This is AEX R&D research, separate from AMO Helix LLC/Nexus. The work uses synthetic/public/low-risk data only. Founder experience may inform hypotheses, but no AMO Helix source code, prompts, customer data, credentials, confidential documents, or proprietary implementation is used or transferred.