What Your AI Is Allowed to Remember—and Who Can Correct It

A system that has read everything sounds like a system that knows everything. Those are two different states, and from the outside they look identical.

That resemblance is the central difficulty with AI memory in a working business. The more context a team feeds a system, the more fluent and specific its answers become — and fluency reads as authority to almost everyone who encounters it, including the people who set the thing up.

Why more context feels like more permission

Watch what happens when a team connects its project archive to an assistant. Before the connection, the assistant hedges: it talks about typical ranges and asks what the client needs. After it, the assistant quotes the figure from a comparable job, names a delivery window, and sounds entirely certain.

That team’s approval process was untouched in between. The only thing that moved was how the answer sounds. An answer that sounds settled gets forwarded, pasted into a client email and repeated in a meeting, and by then it has acquired the weight of a company position while never having been approved as one.

Context and authority arrive through separate doors. Context arrives through an integration, in an afternoon, usually decided by whoever set the tool up. Authority is meant to arrive through a decision made by the people who own the outcome. When only the first door gets used, the second one opens quietly on its own.

What is actually being remembered

“AI memory” is a single phrase covering at least five substances that behave differently under pressure:

• Published facts — prices, policies, service definitions. Safe to recall, valuable to keep current.
• Customer particulars — account state, history, the thing they complained about in March.
• Decisions and the reasoning behind them — the exception that was granted, and why.
• Working drafts — thinking that was captured before it was agreed.
• Access material — tokens and connection details, which belong in a secrets manager.

The fourth is the quiet hazard. A draft proposal sitting in a shared drive is understood by every human who opens it to be provisional, and the folder it lives in and the colleague who wrote it supply that understanding for free. A retrieval system flattens all of it. The draft’s numbers get surfaced in the same steady voice as the approved price list, because the provisional marking everyone was relying on lived in a document title and a bit of shared context, in a form the system was never able to read.

The third is the one worth adding on purpose. A team that stores decisions alongside their reasoning gets an assistant that can say this was approved once, as an exception, for a reason that has since expired. Store the bare decision and it will simply say yes.

Five verbs, granted one at a time

Once you know what is being held, granting authority over it becomes a smaller conversation, because there is a ladder to point at:

1. Read — the system may see the material.
2. Summarise — it may compress the material for a person.
3. Draft — it may produce something a person will review.
4. Recommend — it may assert which option is correct.
5. Execute — it may act, and the act reaches someone outside the review loop.

Each rung is a separate grant. Teams usually hand over the first three at once, because tools arrive with them enabled and each feels small in isolation. The step from summarise to recommend repays a pause: a summary invites the reader to think, while a recommendation invites them to stop thinking. Staff respond to those very differently, whatever the interface calls them.

The Memory Boundary Card

Write the grant down where the work happens. One workflow, one card, six lines: the class of memory in play, how long it persists, who may access it, the highest verb the system is authorised to perform, who may delete it, and who owns correcting it.

The fourth line is what makes this a governance artifact. A card that records what is stored, while staying silent on what may be done with it, leaves open the gap this article is about. Use the ladder’s own words, so there is one place to look when somebody asks how far the system may go.

A filled card for a single workflow, by way of illustration:

Cards make policy usable at the workflow level. A policy has to hold for every case in the organisation, so it accumulates qualifications until applying it under pressure becomes a research task. A card covers one workflow and can afford to be blunt. The same customer record is routine reference material inside a support queue and something far more sensitive inside a marketing export, and one card each says so plainly.

Keep it in the language the team already uses, beside the runbook. The working test is whether a colleague can act on it the first time they read it.

Draft and send are different permissions

Ask a team where their assistant’s authority stops and most will point at execute. Watch the actual workflow and the line has usually drifted further out, because sending often gets folded into drafting by a convenience feature whose description went unread.

These two deserve to be separate grants. A draft stays inside the company and can be corrected in silence. A sent message has reached a person who now believes it and will plan around it, and correcting it costs a second message admitting the first one was wrong. Sending therefore carries a different — and usually much larger — operational risk than the permissions below it.

An assistant that prepares an onboarding message and holds it for review is doing genuine work. The same assistant delivering that message has made a commitment on the company’s behalf. Both arrangements are defensible, and both should be arrived at deliberately.

Correction ownership

Assume the store will eventually hold something wrong, because it will. A price moved. A policy was revised in a meeting and updated in six places out of seven. Somebody typed a customer note between calls and inverted the account status.

Deletion alone is rarely a complete correction. Pulling the wrong figure leaves a hole, and holes invite confident improvisation; stating the right figure leaves an answer, which is what the system was installed to give. Some material does have to go; a privacy request or a legal obligation settles that on its own terms. Even then, whatever replaced it still needs saying somewhere. Deletion from your own store is also narrower than it sounds, since logs, backups and a vendor’s own retention schedules run on rules your team had no hand in writing. Record that limit on the card, so everyone understands in advance what deleting actually accomplishes.

Then put a name in the correction line, and make it the person who owns the underlying fact. Whoever sets prices owns price corrections. The operations lead who maintains the integration will keep it running, and they will also be the last to hear that a service definition changed in a meeting they had no reason to attend.

Start with the workflow that already talks to customers

Choose the one place where an AI system already produces something a customer reads. Write the six lines for that workflow only. Fifteen minutes, one screen, plain language.

Then take it to the person you named in the correction line and ask whether they agree. That conversation is the point of the exercise. When two people discover they had each assumed the other was keeping a shared fact current, the card has already earned its keep, before a single setting has been changed.

Completing it cleanly is a readiness test in its own right. Until a team can fill all six lines and agree on them, drafting is as far as that workflow should go. If you would rather start from a written assessment than a blank card, the diagnostic produces one.