The four-field record exposes an efficiency, security, and sovereignty risk triad

Type: types/note.md · Tags: learning-theory, artifact-analysis, context-engineering

The four fields of artifact analysis — storage substrate, representational form, lineage, and behavioral authority — read like descriptive bookkeeping: where retained behavior lives, how it is encoded, what it derives from, and with what force it acts. But the reason to keep all four visible is not completeness for its own sake. The record exists to surface three recurring architectural review concerns over retained behavior-shaping artifacts: efficiency, security, and sovereignty. Each concern is a question you can only ask once two of the fields are recorded; collapse the fields back into a storage label and the question disappears.

The triad, field by field

Efficiency risk is a representational-form plus behavioral-authority question. It appears when a retained lesson stays in a recurring prompt or retrieval path — paid in tokens, latency, and context bloat on every consumption — even though it could be compressed into a cheaper script, schema check, test, or executable workflow that runs outside model inference and stops competing for context. You cannot see this risk from substrate alone: the same natural-language reflection in a file and a validator in the same repo have identical substrate but opposite efficiency profiles. You see it only when the form (natural-language, interpreted each time) is read against the authority path (loaded into every prompt). The cure in this case is code-extraction codification: move recurring interpretation into a cheaper script or validator, not merely to another store. The savings depend on avoided inference exceeding construction, execution, and maintenance costs over repeated use. Adopting an existing model package as a prompt's governing reference also codifies it, but does not by itself remove its inference or context costs. This is the most general framing of why context efficiency is the central design concern in agent systems: recurring natural-language authority is the default leak.

Security risk is a behavioral-authority plus lineage question. It appears when an untrusted or poisoned artifact enters a high-authority channel, or when a stale derived view survives a source change and keeps governing behavior. Natural-language carries a specific vulnerability here: it blurs the line between data and instruction, so retrieved content can act as instruction the architect never authorized — the indirect-prompt-injection failure Greshake et al. (2023) identify in LLM-integrated applications. The authority field names which channels are high-force (instruction, enforcement, routing); the lineage field names which derived artifacts can drift from a fixed source. The security question is the conjunction: does anything untrusted, or anything stale, reach a high-authority channel? Neither field answers it alone.

Sovereignty risk is a storage-substrate plus representational-form question. It appears when behavior depends on artifacts the system owner cannot inspect, regenerate, delete, or roll back — vendor checkpoints, hosted retrieval indexes, externally-managed model state. Define sovereignty as exactly that owner capability: the ability to inspect, regenerate, delete, and roll back retained behavior. Those are the same four verbs lineage and storage-substrate already track — but read as an ownership and control concern rather than a maintenance concern. Lineage asks "can the system regenerate this when its source changes?"; sovereignty asks "can the owner regenerate it at all, or does that capability live with a vendor?" The verbs are shared; the question shifts from internal upkeep to external dependence.

Sovereignty is the load-bearing new content

Efficiency and security already appear scattered across the artifact-analysis cluster — efficiency in the form/authority cost arguments, security in the prompt-injection and stale-derived-view discussions. Sovereignty does not. It is the genuinely new axis the triad adds, and it is worth stating because it explains a failure the other two miss: a system can be efficient (cheap symbolic checks) and secure (no untrusted input, no stale views) and still be unable to inspect, regenerate, delete, or roll back the artifacts its behavior depends on, because those artifacts are hosted and owned elsewhere. The digital-sovereignty literature treats this as control over the artifacts a system depends on (Couture and Toupin, 2019; Dale, 2025); the four-field record localizes it to substrate and form.

The inspection-method story interacts sharply with sovereignty. Form sets the default inspection method: read natural-language content, check symbolic artifacts against their reference, and behaviorally probe distributed-parametric content under the model-consumption path. For symbolic artifacts, reading is an available route only where the artifact and reference expose the behavior at acceptable cost. The opacity note distinguishes difficulty from scale, the reference's form, and deliberate obfuscation. A short prompt under an adopted model can be symbolic and opaque; adoption does not make its reference readable at the instruction level.

A closed hosted checkpoint or managed embedding index can combine this inspection difficulty with a lack of owner-controlled regeneration, deletion, or rollback. Where the vendor supplies no such controls, the owner lacks both an affordable reading route and control over the retained state. This is why inspectable artifact, not supervision, defeats the blackbox problem is also a sovereignty argument: choosing readable, owner-regenerable scripts or validators buys back inspection and control. Symbolic membership alone buys neither.

Why this matters

The triad turns the four-field record from a classification scheme into a review checklist. For any retained artifact, the architect asks three questions whose terms the fields supply: is its form-and-authority pair leaking recurring cost (efficiency); does anything untrusted or stale reach a high-authority channel (security); can the owner inspect, regenerate, delete, and roll back it (sovereignty). The fields were always the answer to "how does this artifact act?" The triad names the three things you were trying to find out when you asked.

This synthesis is refined beyond what the notes held: the KB's own ASIS&S 2026 position paper sharpened the triad framing — especially the sovereignty axis — and that refinement flows back here into the notes, rather than the notes deriving from the paper.

Open Questions

• Sovereignty and lineage share the same four verbs (inspect, regenerate, delete, roll back) read under different ownership assumptions. Is sovereignty a distinct field, or a lens on the substrate/lineage pair worth promoting to a definition only if it earns repeated use?
• The triad is presented as covering the recurring concerns, but the position paper calls the field set non-exhaustive. Are there review concerns (auditability, fairness, cost attribution) that need a fourth member rather than folding into these three?

---

Relevant Notes:

• Axes of artifact analysis — extends: the four fields exist to surface the efficiency/security/sovereignty triad, not just to describe artifacts
• storage substrate — defined-in: sovereignty's externally-hosted worst case is a substrate property
• representational form — defined-in: form guides inspection, while the consumer's cost and the opaque modifier determine whether an efficient, affordable route exists
• lineage — defined-in: security's stale-derived-view mode and sovereignty's regenerate/roll-back verbs are lineage concerns read differently
• behavioral authority — defined-in: efficiency and security both turn on which channel carries high force
• codification — mechanism: extracting recurring interpretation into cheaper scripts or validators can remove inference cost; adoption-based codification alone does not
• Context efficiency is the central design concern in agent systems — grounds: recurring natural-language authority is the default efficiency leak the triad names
• Opacity — mechanism: affordable inspection depends on scale, the reference's form, and obfuscation, independently of owner control over the stored artifact
• inspectable artifact, not supervision, defeats the blackbox problem — extends: choosing a readable owner-regenerable form is also a sovereignty move