Diagram interlude
Authority stays at the execution boundary.
The model can propose. HELM checks whether the proposed action has policy, scope, approval, and proof before any side effect crosses into company systems.
The Illusion of RAG as Governance
Retrieval-Augmented Generation (RAG) and long-term memory systems are critical for providing context to AI agents. They allow models to recall past interactions, access internal documentation, and maintain state over long conversations.
However, a dangerous misconception has emerged: the belief that memory equates to authority. Injecting a policy document into a model’s context window does not guarantee the model will follow that policy. It merely increases the statistical likelihood that the model’s output will reference it.
Context is Suggestive, Not Restrictive
In the HELM architecture, we maintain a strict philosophical boundary: Memory Is Not Authority.
- Memory (Stochastic): The context provided to the model. It informs the model’s proposal of what to do. It is suggestive.
- Authority (Deterministic): The execution runtime and its hardcoded policies. It dictates what the system is allowed to do. It is restrictive.
The Problem with Context-Based Rules
If you tell an LLM via a system prompt, “Never delete a user account,” you are relying on the model’s stochastic adherence to that instruction. A clever jailbreak, a conflicting piece of context, or simply a statistical anomaly can cause the model to ignore the rule.
The HELM Solution: Structural Enforcement
HELM does not rely on the model to enforce policies. Instead, the rules are embedded in the deterministic execution layer.
- The model proposes deleting a user (perhaps erroneously).
- The execution layer intercepts the proposal.
- The deterministic policy engine evaluates the action and rejects it, because the agent’s service account lacks the
delete_userpermission.
By separating memory from authority, HELM keeps context in the proposal path. Side effects still need policy, approval when needed, and a receipt.