The $6,000 we couldn't take back

Description and use

Deleting a compromised source from an AI agent’s memory does not remove downstream beliefs, plans, or actions, leading to unintended payments. The solution stores reasons for every memory in FalkorDB and retracts contaminated chains, moving the $6,000 payment to a recall list and blocking further payments that rely on insufficient independent sources.

Problem

When an AI agent trusts a poisoned source, deleting the source does not remove downstream beliefs, plans, or actions, leading to unintended payments.

Outcome

The retraction system removed the contaminated bank account and associated memories, placed the $6,000 payment on a recall list, and blocked a pending $34,500 payment. It prevented further payments that relied on fewer than two independent sources.

Workflow

• 1. Store each memory with edges to its reasons in FalkorDB.
• 2. When retracting, mark the source’s observations as OUT.
• 3. Mark all downstream memories as OUT tentatively via a variable‑length match.
• 4. Iterate until no memory has all premises OUT, then set surviving memories to IN.
• 5. Preview the retraction on a GRAPH.COPY, commit to apply, or reinstate to revert.

Evidence

When a source an AI agent trusted turns out to be poisoned, deleting it does almost nothing. Everything the agents built on it stays.

Source

We store the reasons for every memory as edges in FalkorDB.

Source

A memory is believed if at least one of its reasons is fully intact.

Source

In our demo the preview reads: one source, two observations, four beliefs, two plans, three actions. One pending payment ($34,500) is blocked.

Source