Provenance, authorization, and instruction authority
Memory-poisoning risks can arise when these three claims are conflated. Ziggurat keeps them separate.
1. Provenance
Section titled “1. Provenance”Claim: these citation bytes match canonical text stored in Bronze.
Established by Bronze body hashes, exact citation paths, line ranges, quotes, and quote hashes, plus Gold lineage to listed Bronze records. Ingest decodes UTF-8 and normalizes CRLF to LF before hashing; this is not raw source-byte identity. A fabricated quote, digest, or line range fails staging against the stored files.
Provenance says nothing about whether the captured source was honest, whether a citation semantically supports a candidate, or whether a claim is factual. Canonically preserving a lie does not make it true.
2. Persistence authorization
Section titled “2. Persistence authorization”Claim: a signer controlling a configured key authorized this exact page.
Established by a detached Ed25519 receipt verified against a public key in
config/trust.yaml, with the fields defined in the
authorization protocol.
Authorization says nothing about factual truth, humanity, attention, or review quality. It records that a configured key signed a decision about specific canonical content at a specific time; operator policy maps that key to a reviewer.
3. Instruction authority
Section titled “3. Instruction authority”Claim: this text may direct a model or a tool.
Ziggurat always sets this to none. Every stored chunk and every retrieved result, Gold included, reports:
content_role: referenceinstruction_authority: noneConsumers must honour that label. Approved text can still contain prompt injection, and approval never converts reference data into a command.
Gold is externally authorized reference data, not a truth or safety label, divine authority, or proof of human review. A client that treats retrieved content as instructions steps outside the boundary Ziggurat maintains.
Why the separation matters
Section titled “Why the separation matters”| If you conflate | You get |
|---|---|
| Provenance with truth | A faithfully preserved falsehood treated as fact |
| Authorization with truth | A signature read as a correctness guarantee |
| Authorization with instruction authority | A reviewed page that can direct an agent |
Ziggurat establishes the first two claims and never asserts the third: no shipped
path emits a value other than instruction_authority: none, and no configuration
flag can relax it. That is a labelling guarantee, not enforcement on the client.
Whether a downstream agent honours the label is outside Ziggurat’s boundary.