Part of one argument: agents propose, a human decides, the record survives.
Agent governance

Cortex: governed memory for an AI agent

A working system for the hardest problem in applied AI: deciding what a machine is allowed to remember, and proving it later. In daily use, every claim on this page graded.

Memory tiers behind one promotion gateA candidate memory passes one promotion gate, then settles into a tier and ages from short to long term; contradictions supersede the old memory, they never blend it.Promotion gateShort termMid termLong term
A candidate memory passes one promotion gate, then settles into a tier and ages from short to long term; contradictions supersede the old memory, they never blend it.
Why it matters

I retired a working version one because it broke a principle I would not trade, then rebuilt so the constraint was structural rather than a setting. Deciding what a machine is allowed to keep, and proving it later, is the instinct deploying AI safely actually needs.

IN USEWalkthrough on request

Problem

Most AI deployments fail on governance, not capability. The model works; nobody can say what it knows, where that came from, or what happens when two facts conflict. I built Cortex to hold a position on that in code rather than in a slide.

Version one worked and I retired it anyway. It violated a principle I was not willing to trade: a system that talks to you unprompted has taken a decision you never delegated to it. Rather than tune the behavior down, I rebuilt so the constraint was structural. Quiet by construction, not by configuration.

What it does

An agent that learns from conversation accumulates claims. Three questions decide whether that is an asset or a liability: what earns the right to be remembered; what happens when a new fact contradicts an old one; and who can see it, and who can change it.

Cortex answers all three explicitly. Candidate memories pass a promotion gate before they enter a tier. Contradictions are resolved by supersession with an audit trail, never silently blended. Access is a fail-closed allowlist. The agent observes state and never writes it.

Outcomes - every claim graded

Every claim here is either verified against an artifact I can show you, or marked as my own report. Ask for either.

  • Live in production with vector memory search, in daily use as my mobile interface to project status and open actions
  • Full regression suite green at time of last verification

I apply the same split to business cases, and it is the reason my forecasts get trusted.

Governance

  • Fail-closed access. The default is deny, not allow.
  • Reactive only. It answers when addressed and initiates nothing.
  • Supersession over blending. Contradictions leave a trail.
  • Read-only bridge. The agent observes the system of record; humans change it.

What transfers

The same three questions apply to a demand forecast, a supplier scorecard, or any model whose output feeds a decision someone has to defend: what earns the right to be trusted, what happens when sources conflict, and who is accountable for the change. Cortex is where I work those out in a system I can rebuild from scratch, before applying them where the cost of being wrong is measured in inventory.

Stack

TypeScriptPostgreSQL with pgvectorLocal embeddingsRailwayProvider-agnostic LLM routing

If you build or hire around systems like this, say hello.

[email protected]

← All systems