Open architecture specification for provenance-aware AI systems and institutional memory.
Write-Side Custody is the architectural discipline of governing admission to durable state.
It treats a write as a governed operation rather than merely a storage operation. Before information commits to long-term memory, custody evaluates:
Structural validation, provenance binding, authority evaluation, metadata enrichment, and integrity mechanisms may all participate in that decision while the source context and evidence are still available.
The governing principle is:
Custody governs admission. It does not declare permanent truth.
The term Write-Side Custody was first formalized as part of the Sovereign Systems Specification by Ken W. Alger in 2026.
Many systems defer governance, provenance, and evidence questions until retrieval.
By then, questionable information may already have become durable state, entered indexes, influenced summaries, propagated into derived records, or lost the context needed to determine who asserted it and under what authority.
Write-Side Custody moves the admission decision to the boundary where the system still has its strongest opportunity to preserve the evidence surrounding the proposed write.
flowchart LR
A["Agent / Application"] --> B["Proposed Write"]
B --> C["Write-Side Custody"]
P["Policy / Authority"] --> C
E["Provenance / Evidence"] --> C
C -->|"Admitted"| D["Durable State"]
C -->|"Rejected"| X["Non-Durable"]
C -.->|"Decision witnessed"| F["Reasoning Ledger"]
C -.->|"Evidence bound"| R["Forensic Receipt"]
classDef capture fill:#378ADD,stroke:#378ADD,color:#FFFFFF
classDef governance fill:#1D9E75,stroke:#1D9E75,color:#FFFFFF
classDef memory fill:#BA7517,stroke:#BA7517,color:#FFFFFF
classDef boundary fill:#6B7280,stroke:#6B7280,color:#FFFFFF
classDef failure fill:#C0392B,stroke:#C0392B,color:#FFFFFF
class A,B capture
class C,P,E,F,R governance
class D memory
class X failure
The architecture does not assume that every proposed write can be made trustworthy.
It requires the system to make admission explicit and preserve enough evidence to explain what crossed the boundary, what did not, and why.
Write-Side Custody is not a truth-detection mechanism.
Admissibility, authority, evidence, and truth are distinct questions.
A claim may be factually correct and still be inadmissible because the source lacks authority to establish that claim within the governed system.
For example, a vendor’s marketing site may truthfully state that its product is suitable for regulated workloads.
That does not make the vendor authoritative for an organization’s internal security policy.
Likewise, a structurally valid and cryptographically signed assertion may still be inadmissible if the signer lacks the authority required by policy.
Admission means:
This information was permitted to become durable state under the authority, evidence, and policy available at the time.
It does not mean:
This information is permanently true and authoritative.
Write-Side Custody distinguishes between what a writer may report about itself and what it may establish about the surrounding system.
An agent may legitimately report:
Runtime-observable facts should ordinarily be asserted by components capable of witnessing them.
Examples include:
flowchart TD
A["Proposed Record"] --> B["Writer-Supplied Claims"]
A --> C["Witnessed Facts"]
B --> D["Assertion Authority Evaluation"]
C --> D
D -->|"Authorized"| E["Eligible Record"]
D -->|"Unauthorized Property"| X["Reject or Constrain"]
classDef capture fill:#378ADD,stroke:#378ADD,color:#FFFFFF
classDef governance fill:#1D9E75,stroke:#1D9E75,color:#FFFFFF
classDef memory fill:#BA7517,stroke:#BA7517,color:#FFFFFF
classDef boundary fill:#6B7280,stroke:#6B7280,color:#FFFFFF
classDef failure fill:#C0392B,stroke:#C0392B,color:#FFFFFF
class A capture
class B boundary
class C,D,E governance
class X failure
Custody therefore evaluates not only whether a record may be written, but whether the writer is authorized to assert each governed property of that record.
A structurally valid record does not make every field equally authoritative.
A schema can validate shape. It cannot grant assertion authority.
Structural validation remains important.
A proposed write may need to satisfy schema requirements, field constraints, type rules, encoding rules, or canonicalization requirements before the system can safely process it.
But structural validity answers a narrow question:
Does this record conform to the expected representation?
It does not answer:
Is this writer entitled to establish every claim represented by those fields?
Sovereign Systems keep those responsibilities separate.
A record can be structurally valid and unauthorized.
A record can also be authorized in principle while failing structural validation.
Both conditions may justify rejection, but for different reasons.
Custody uses Provenance to determine what evidence ancestry and verification semantics accompany a proposed write.
Relevant provenance may include:
Custody does not need every write to have the strongest possible provenance.
It needs the provenance required by the governing policy for that class of write.
A low-consequence observation may be admissible with a self-reported source.
A high-consequence authority record may require independently retrievable evidence, a trusted authority, cryptographic integrity, or independent witnessing.
The important requirement is that weaker provenance is not silently promoted into stronger provenance merely because the record was admitted.
Information often changes representation before admission.
It may be parsed, normalized, summarized, extracted, converted, enriched, or mapped into a new schema.
Those transformations can preserve evidence continuity, weaken it, or break it.
flowchart LR
A["Source Evidence"] --> B["Transformation"]
B --> C["Proposed Durable Record"]
C --> D["Write-Side Custody"]
B -.->|"Continuity preserved"| E["Preserve Evidentiary Status"]
B -.->|"Continuity weakened"| F["Degrade Evidentiary Status"]
B -.->|"Continuity cannot be established"| U["Unknown / Unverifiable"]
E --> D
F --> D
U --> D
classDef capture fill:#378ADD,stroke:#378ADD,color:#FFFFFF
classDef governance fill:#1D9E75,stroke:#1D9E75,color:#FFFFFF
classDef memory fill:#BA7517,stroke:#BA7517,color:#FFFFFF
classDef boundary fill:#6B7280,stroke:#6B7280,color:#FFFFFF
classDef failure fill:#C0392B,stroke:#C0392B,color:#FFFFFF
class A,D,E governance
class B,C capture
class F,U boundary
Custody must not silently promote the epistemic status of transformed information.
A derived claim should preserve the evidence from which it was derived and the method used to produce the derivation where that information is consequential.
Replayability alone does not establish verification.
The system must still be able to establish that the inputs, transformation, representation, and authority correspond to the claim being admitted.
Write-Side Custody evaluates admission under an explicit policy.
The policy may govern:
This allows admission requirements to vary by consequence.
For example, a personal note, observed sensor reading, financial approval, software deployment, and institutional policy may all require different evidence and authority.
The architecture does not require one universal admission rule.
It requires the rule governing a consequential write to be identifiable and auditable.
A custody boundary must be allowed to reject a write.
Rejection should not be encoded as a successful write with missing fields, a default authority, an empty provenance object, or a later cleanup task.
When the required basis for admission cannot be established, the correct outcome may be non-admission.
flowchart LR
A["Proposed Write"] --> B["Admission Evaluation"]
B -->|"Requirements satisfied"| C["Admitted"]
B -->|"Requirements not satisfied"| X["Rejected"]
B -->|"Policy permits constrained state"| U["Admitted with Explicit Constraint"]
C --> D["Durable State"]
U --> D
classDef capture fill:#378ADD,stroke:#378ADD,color:#FFFFFF
classDef governance fill:#1D9E75,stroke:#1D9E75,color:#FFFFFF
classDef memory fill:#BA7517,stroke:#BA7517,color:#FFFFFF
classDef boundary fill:#6B7280,stroke:#6B7280,color:#FFFFFF
classDef failure fill:#C0392B,stroke:#C0392B,color:#FFFFFF
class A capture
class B,C governance
class U boundary
class D memory
class X failure
Some policies may permit information to become durable with an explicit state such as unverified, unverifiable, disputed, or historical.
That is different from silently treating the record as fully authoritative.
Unknown is a state. Missing governance is a defect.
The authority that permitted a write at time T may not remain valid forever.
After admission:
Write-Side Custody therefore preserves the evidence needed for later revalidation.
flowchart LR
A["Admission<br/>Authority A · Evidence E · Policy P · Time T"] --> B["Durable State"]
B --> C["Dependency / Authority Change"]
C --> D["Revalidation"]
D --> E["Current"]
D --> F["Stale"]
D --> G["Superseded"]
D --> H["Corrected"]
D --> I["Invalidated"]
D --> U["Unverifiable / Undetermined"]
classDef capture fill:#378ADD,stroke:#378ADD,color:#FFFFFF
classDef governance fill:#1D9E75,stroke:#1D9E75,color:#FFFFFF
classDef memory fill:#BA7517,stroke:#BA7517,color:#FFFFFF
classDef boundary fill:#6B7280,stroke:#6B7280,color:#FFFFFF
classDef failure fill:#C0392B,stroke:#C0392B,color:#FFFFFF
class A,D governance
class B,E,F,G,H,I memory
class C,U boundary
Admission is therefore a historical governance decision.
It is not a permanent grant of authority.
Admission is where a system buys the right to expire something later.
Lifecycle and authority states are meaningful only if downstream consumers are required to respect them.
A record marked superseded should not remain an unconstrained peer of the record that superseded it.
A record marked invalidated should not continue to govern simply because semantic ranking places it first.
A record whose provenance is unverifiable should not silently retain the same eligibility as independently verified evidence when policy distinguishes those states.
Consequential state may affect:
A consequential state transition must change the behavior of the next consumer, not merely the metadata available to it.
A constrained state that ranking is free to ignore is a comment with better formatting.
Provenance describes evidence ancestry and verification semantics.
Write-Side Custody uses that information to govern admission.
Custody may require provenance fields, bind assertions to sources, preserve verification anchors, record authority dependencies, or reject a write whose required provenance cannot be established.
Admission does not permanently settle the provenance question.
The evidence preserved during custody provides the basis for later revalidation when sources, authority, policies, keys, or dependencies change.
Custody establishes governed admission. Provenance preserves what future consumers need to evaluate that admission.
A Forensic Receipt preserves structured evidence about a consequential event under a defined representation, integrity mechanism, and trust model.
Write-Side Custody makes the admission decision.
The receipt preserves evidence about that decision and the boundary conditions observable at the time.
A receipt may bind:
A receipt cannot reconstruct source authority, provenance, or causal context that custody never captured.
Likewise, cryptographic consistency does not retroactively make an inadmissible write authoritative.
The two mechanisms are complementary, but they answer different questions.
Write-Side Custody and the Reasoning Ledger have separate responsibilities.
Write-Side Custody governs whether a proposed write may become durable state.
The Reasoning Ledger preserves observable evidence surrounding consequential decisions and operations, including custody decisions where appropriate.
The ledger does not grant permission to write.
Custody does not replace the historical record of what evidence, policy, authority, and outcome surrounded the decision.
Custody enforces. The ledger witnesses.
Durable Memory preserves state after admission.
Custody governs the transition into that state.
This distinction means that durable information need not remain current, authoritative, or eligible to govern forever.
Durable Memory may preserve historical, superseded, corrected, invalidated, disputed, or unverifiable records while downstream governance determines which records are eligible for a present decision.
The write boundary should therefore preserve the dependencies needed to distinguish:
This record was legitimately admitted then.
from:
This record is entitled to govern now.
The Sieve-and-Sign Pattern provides mechanisms that may participate in Write-Side Custody.
The Sieve can perform structural filtering, normalization, classification, evidence checks, or other admission-oriented transformations.
The Sign stage can create integrity evidence for a defined representation under an explicit trust model.
Neither stage independently establishes truth or permanent authority.
Write-Side Custody is the broader governance discipline that determines what those mechanisms mean within the admission decision.
Sovereign Systems treat ingestion as a critical control point because it is the last opportunity to govern admission before proposed information becomes durable state.
A conforming design should:
The objective is not to guarantee that every admitted claim remains correct forever.
The objective is to ensure that durable state enters the system through an explicit governance boundary with enough evidence to understand who asserted it, why it was admitted, what authority and policy applied, and how its status can be reevaluated later.