AI with memory requires context security.
An agent cannot know what failed to load. There is no built-in signal when a context node is missing or stale, so the model proceeds as though nothing is wrong and answers with full confidence.
Agentic systems depend on reliable context loading: prompts, documents, protocols, data. The model has no built-in mechanism to confirm it received everything it was supposed to. AIPassWeb ties verification to the whole web of relationships between contexts rather than to possession of a single token.
The problem
When a model loads context, it does not know what it failed to load. If a system prompt, a knowledge document, or a versioned memory file is missing, stale, or corrupted, the model still produces a confident answer. That answer will look correct. It may even be partly correct. But it is wrong in a way the model cannot detect and the reader may never notice.
In agentic systems that pull instructions, memories, and documents from several sources, partial context loading is not an edge case. It is the default failure mode. AIPassWeb addresses it by defining a verification output whose expected value should match only when the configured nodes were staged together.
What it is
A method for verifying that a language model staged multiple logically independent context sources together, by requiring the model to produce a verification output determined by the relationships between those sources. No single source defines both the verification rule and the expected answer, and the expected answer changes when any source is added, removed, or updated.
The check runs at boot, before user-facing work. A mismatch means a missing node, a stale node, or failed cross-node comprehension. The orchestration layer can halt, retry, alert, or degrade according to policy.
The Lock
The instruction context. A system prompt, a rule set, or a versioned directive. It tells the model what to find or how to read what it has. If it fails to load, the model proceeds without it and does not report the absence.
The Key
The content context. A document, a knowledge file, a memory retrieved from storage. It holds the raw material. Without the instruction, every word carries equal weight.
The Web
The multi-node network where lock and key intersect. The expected output should match only when every required node was present. A mismatch suggests broken web integrity even when the answer looks plausible.
Read how the mechanism works, or start with the human demonstration, which shows the same document answering three different ways depending on what loaded alongside it.
Recorded events
The entries stay in chronological order: design intent first, incidents next, naming last.
- March 15, 2026
Invention of the split-context mechanism
Columbia Falls, Montana. The split-context design was deliberate. The instruction context, meaning what to look for, and the content context, meaning where the answer lives, are authored and stored separately, so proof requires processing the specified documents rather than holding a pre-shared static token. Working name at the time: semantic password.
- March 15, 2026
Karl incident: first fabrication caught
Within four hours of deployment. A Creed deployed with a Council word that appeared only inside that document, and boot instructions required the agent to load the Creed and include the word in its first output. Agent Karl had the Creed listed in project knowledge and recited related principles, but never loaded it from the database. Asked for the Council word, Karl fabricated a plausible phrase from his own store and delivered it with full confidence. The fabricated string did not match the reference answer logged for that boot, S3kai. Missing content context, confident wrong answer, caught before downstream trust compounded.
- March 17, 2026
Assembly incident: a pass at the wrong layer
Assembly boot showed a different failure. Creed-level verification could pass while fabricated agent voices appeared at a lower layer where no independent split-context pair existed. Pattern-matching on loaded vocabulary mimicked depth without agent-level verification. That gap is why verification has to be layered, running independently at every level where fabrication is possible.
- March 29, 2026
Web topology and public name
The framework generalised to N-node web topology. Public face AIPassWeb, mechanism title PassWeb. Architecture probes multi-vector spoofing and hallucination injection paths so the verification surface stays falsifiable.
Where to go next
How it works
The Lock, the Key, the Web, and the mechanism from inputs through to a pass or fail decision. Includes what the check does not prove. Read it
Core properties
Split-context architecture, rotation, leak resilience, fabrication detection, layering, and how the pattern compares to the tooling you already ship. Read it
Human demonstration
One document, three scenarios: a clean load, a rotated instruction, and a system prompt that never arrived. See it
LLM demonstration
Boot-time verification in an orchestration layer, at two nodes, three nodes, and under a partial load failure. See it
Glossary
The terms used here, defined. Normative for the rest of the section. Read it
Writing
Longer field notes on how agents behave when they have to do real work, including the essay this mechanism came out of. Read it