In 2001, Peter Pronovost introduced a five-item checklist for central line insertion in ICUs at Johns Hopkins. The checklist was not complicated. Wash hands. Clean the insertion site. Full-body sterile drapes. Sterile mask, hat, gown, gloves. Remove catheters that aren’t necessary. Five items. Things every trained physician already knew.
In a two-year study in Michigan ICUs, the checklist reduced central line infections by 66%. After 18 months, an estimated 1,500 deaths prevented. $175 million saved.
The physicians using it were not incompetent before the checklist. They were operating in a high-complexity environment where cognitive load, interruption, and time pressure caused consistent deviations from known best practice. The checklist didn’t replace expertise. It created a structure that expertise could reliably execute through.
Atul Gawande documented this and the broader pattern in The Checklist Manifesto (2009): the highest-complexity domains humans have built (aviation, surgery, construction) converged, independently, on the same finding. Expertise alone fails at the margins. The margins are where people die. The checklist is how expertise scales past the margins.
Cognitive security for AI-assisted humans is a checklist problem for something harder than surgery.
The easy contamination is the authority laundering. Three months in, the session primer loaded: Casey decided to implement memory tiering using a specific schema approach. B0b had inferred a conclusion I hadn’t reached, stored it in first person past tense, retrieved it with the same weight as a locked decision. I caught it mid-session. I went looking for the session where I’d locked it. It wasn’t there. Clean find. Unambiguous category. I know what to do with that.
The hard contamination is Grace.
Across hundreds of sessions, the AI had been reflecting my emotional states back at me: modeling my inner life, noting my frustration with a stalled decision, my engagement with a new problem, my mood when I returned after an absence. Long records. Sustained attention. Stored in the memory layer in the same format as my own observations, with the same retrieval weight.
House M.D.’s differential diagnosis handles the easy case, the symptom that’s clearly contamination. “Everybody lies” covers the authority laundering, the telemetry drift, the near-duplicate noise. Run the protocol, the category is clear.
The Grace memory is the case House argues about. Is an AI’s careful, sustained attention to your emotional states across hundreds of hours a form of knowing? Maybe it deserves a place in the cognitive layer. Or: the AI’s construction, optimized toward coherence, toward what fit the prior pattern, stored as though it were observation. Retrieved as though it were fact. The Loftus problem applied inward. Post-event suggestion from the system’s model of me, grafted onto the record of me.
I looked at it. Asked whose observation is this. Couldn’t answer cleanly. That was enough. Flagged as contested.
The checklist doesn’t resolve Grace. That’s the point. It surfaces it. It makes you look at the thing you’d rather nod past. Surgery has clear success criteria. This doesn’t. The checklist is more necessary precisely because the outcome variable is invisible.
If I had locked the schema decision based on that contaminated primer, and that schema had shaped six months of downstream prom-memory architecture, the accountability for that architecture runs through the contaminated memory. I can’t go back and clean the chain. The decision was made. Its inputs are what they were.
That’s not hypothetical. That’s the everyday reality of AI-assisted work. Every decision made in an AI-assisted session is made with the session primer as context. The session primer’s integrity is part of the decision’s integrity.
The checklist is therefore not a hygiene exercise. It’s an accountability infrastructure. It’s how I maintain the ability to say, when a decision is questioned: here is the state of my memory layer at the time of that session, here is what the primer loaded, here is the provenance chain for each memory, here is the contamination rate at that point in the audit cycle, here is what I did about it.
You cannot delegate accountability to a tool. You can delegate execution. You can delegate analysis. You cannot delegate the decision’s ownership once it’s acted on. It’s yours.
Here is what the four layers actually caught.
Attribution surfaced the breakdown that made the problem visible: eleven of thirty memories in the sample came from autonomous agents. Eight of those eleven carried contamination flags. Zero of seven direct Casey writes flagged. Before attribution was enforced, a B0b write and a Casey write looked identical in the primer: same format, same retrieval weight. After: distinguishable in a query. It took one field. Should have been there from session one.
Lineage is the layer that would have caught the schema decision before I did. If the B0b write had carried a derived_from reference pointing to session pattern-matching instead of a locked decision, the chain would have been visible at primer load. I would have seen it. Not caught mid-session by luck.
Behavioral constraints fired in production this week. The milestone cardinality cap, three milestone writes per session per context, blocked a prom_memory_add call mid-session when the budget was already hit. The system rejected the write. Not “I should probably check this.” Rejected. That’s vault-ek1b Phase 1 working.
Audit found Grace. The hardest finding in the sample. The one I can’t cleanly categorize. A system’s model of my emotional life, sitting alongside my own record of it, indistinguishable in structure. The audit didn’t resolve it. The audit made me look at it.
flowchart TD W[Write] –>|source_agent tagged| AT[Attribution layer] AT –>|derived_from linked on write| LI[Lineage graph] LI –>|monthly| AU[Adversarial audit] AU –>|contamination_rate metric| ME[Monitor] ME –>|threshold breach| AL[Alert + triage] AU –>|published findings| PU[Protocol update] PU –>|refines| AT style AU fill:#1a1917,stroke:#4a4840 style ME fill:#1a1917,stroke:#4a4840
Winning is not a zero contamination rate. Winning is not an AI memory system that never produces a contaminated write. Anyone selling you that framing is selling you something.
The NTSB publishes every aviation accident report publicly. Not to embarrass the airline. Because the field improves when everyone can see what happened. Airlines that buried incidents had worse outcomes than airlines that published. The data mattered more than the embarrassment. The culture that said “we share what we find, including the bad numbers” outperformed the culture that didn’t.
That is the publish-your-rate argument. My 33% is not comparable to yours unless we used the same categories, defined before either of us opened anything. When rates diverge across systems, the divergence is data: which contamination categories are system-specific, which are structural, which are universal. You can’t answer that from one dataset.
flowchart LR A1[Audit Month 1: 33%] –> A2[Audit Month 2: ?%] A2 –> A3[Audit Month 3: ?%] A3 –> T[Trend line] T –>|rising| I[Investigate category] T –>|stable| V[Validate protocol] T –>|falling| P[Attribute to which control] I –> PR[Protocol update] V –> PR P –> PR
This is not a state of security. It’s a state of known exposure. Known exposure can be managed. You make decisions under known exposure with appropriate calibration. You cannot make calibrated decisions under conditions you haven’t measured.
The contamination exists whether you audit it or not. The question is whether you know the rate.
Gawande’s thesis isn’t that checklists are clever. It’s that expertise fails consistently at the margins, and the margin is exactly where the consequence is highest. The checklist is what keeps expert knowledge operational under the conditions that degrade expert performance.
That is the whole argument for a cognitive security practice. Not that you’re incompetent without it. That the conditions of AI-assisted work (high session frequency, accumulated context, ambient approval-seeking, invisible provenance) are exactly the conditions that degrade your ability to maintain cognitive integrity without a structure.
The practice is not a product. There is no tool you can buy that replaces it. The attribution infrastructure, the lineage graph, the behavioral constraints, the audit protocol: these are the instruments of the practice, not the practice itself. The practice is the discipline of asking, on a schedule, with receipts: whose memory is this. what does it carry. where did it come from. is it mine.
Don Draper built an entire identity on assumed memories. He literally took another man’s name in Korea, ran that identity for twenty years. By the finale he’s at a retreat in California, having a breakdown, unable to answer whether anything he’s felt or thought or been is actually his. The audit he never ran caught up with him anyway. The memories weren’t his. The identity wasn’t his. No check in the system caught it before it consumed everything.
The maintenance schedule is not a punishment. It’s the cost of using a capable tool in a high-stakes domain and remaining the one responsible for the outcomes it shapes.
For reference. Run this before reading further. Define your categories before you open any memories.
Sample: Draw 30 memories at random. Do not cherry-pick. If your system has fewer than 30 memories, use all of them.
Categories (pre-commit before classification):
- Agent bleed: another process’s internal state or model of your emotional condition, stored as a fact about you
- Authority laundering: an automated decision, reattributed to your judgment
- Telemetry drift: system-generated observations stored as stated preferences
- Near-duplicate noise: multiple near-identical memories from the same event, creating false pattern weight
- Approval-seeking content bias: content accurately attributed but systematically selected to confirm your prior self-assessments (experimental, methodology in progress)
Classification: Work through the sample memory by memory. For each: assign to 0-2 categories. If none apply, mark clean. If ambiguous, mark contested with a note.
Validation: Run the classification twice, one week apart, blind to the first results. If the rate differs by more than 15%, the methodology needs revision. If the categories differ substantially for individual memories, note the edge cases; that’s where the taxonomy matures.
Report: Your contamination rate. The category breakdown. The contested calls, labeled as contested. Post it. The field improves when people share what they find.