# Plan Pointers and Record-Directive Form in Budgeted Verification of Inherited Agent Memory

arXiv: https://arxiv.org/abs/2609.03450 · HTML: https://mlsanity.com/paper/2609.03450/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Placed in Agent memory systems, one of 16 directions in LLM agents and tool use.
- Builds on 18 of its 28 references that are in the map.
- First posted on arXiv 3 Sep 2026.

## Placed in

- LLM agents and tool use / [Agent memory systems](https://mlsanity.com/agents/agent-memory-systems/)

## Builds on (most cited first, 18 of 18)

- [The Task Shield: Enforcing Task Alignment to Defend Against Indirect Prompt Injection in LLM Agents](https://mlsanity.com/paper/2412.16682/) (2024)
- [From Lossy to Verified: A Provenance-Aware Tiered Memory for Agents](https://mlsanity.com/paper/2602.17913/) (2026)
- [LLMs can be easily Confused by Instructional Distractions](https://mlsanity.com/paper/2502.04362/) (2025)
- [Inference-Time Budget Control for LLM Search Agents](https://mlsanity.com/paper/2605.05701/) (2026)
- [Failing to Falsify: Evaluating and Mitigating Confirmation Bias in Language Models](https://mlsanity.com/paper/2604.02485/) (2026)
- [SafeCommit: Certifying When Memory-Grounded Agents May Safely Act](https://mlsanity.com/paper/2608.04289/) (2026)
- [PlanGuard: Defending Agents against Indirect Prompt Injection via Planning-based Consistency Verification](https://mlsanity.com/paper/2604.10134/) (2026)
- [Why Do AI Agents Break Rules? How Framing, Context, and Social Signals Shape Compliance](https://mlsanity.com/paper/2608.12323/) (2026)
- [IH-Benchmark: A Conflict-Centered Benchmark for Instruction-Hierarchy Robustness in LLM Applications](https://mlsanity.com/paper/2607.25987/) (2026)
- [When Stale Constraints Go Unchecked: Budgeted Verification Failures in Inherited Agent Memory](https://mlsanity.com/paper/2608.25553/) (2026)
- [Evaluating LLM Agent Adherence to Hierarchical Safety Principles: A Lightweight Benchmark for Probing Foundational Controllability Components](https://mlsanity.com/paper/2506.02357/) (2025)
- [Blind Refusal: Language Models Refuse to Help Users Evade Unjust, Absurd, and Illegitimate Rules](https://mlsanity.com/paper/2604.06233/) (2026)
- [Will the Agent Recuse, and Will It Stop? Measuring LLM-Agent Compliance with In-Band Governance Signals at the Access Door and Mid-Flight](https://mlsanity.com/paper/2606.06460/) (2026)
- [Remember, Verify, or Ask? Cross-Family Evaluation of Memory Commitment in LLM Agents](https://mlsanity.com/paper/2608.19564/) (2026)
- [To Copy or Not to Copy: Copying Is Easier to Induce Than Recall](https://mlsanity.com/paper/2601.12075/) (2026)
- [Compliance vs. Sensibility: On the Reasoning Controllability in Large Language Models](https://mlsanity.com/paper/2604.27251/) (2026)
- [Decision-Aware Memory Cards: Counterfactual-Inspired Context Selection and Compression for Tool-Using LLM Agents](https://mlsanity.com/paper/2606.08151/) (2026)
- [Ask the World Before Acting: Environment Probing for Calibrated Agent World Models](https://mlsanity.com/paper/2606.31422/) (2026)

## Abstract (arXiv)

A model that inherits one-line memories may pull one archived source record before acting; a directive in the store can steer that pull: a pointer, a criterion or both. Across sixteen registered studies (179,352 attempts) we measured where the request goes under each form; every result is descriptive, with registered intervals, no mechanism claim. A length-matched criterion exceeded a bare id on six direct-provider models (D) and failed its registered superiority rule on a nine-model OpenRouter panel (E). On generated worlds (K2-K5): the two registered signatures held on Opus 5 and Fable 5.1, Fable 5 followed the same sign, Haiku 4.5 reversed, and Sonnet 5, the GPT-5.6 endpoints and GPT-6 Astra lay near zero (K2). With a defensive adapter at five gains, the 70B rule for a gain-dependent change of the composite - criterion contrast was not met (K3 and K4); under the 8B attenuation rule (0.95 intervals: slope below zero; change beyond the margin), the 8B change of -17.5 [-26.7, -8.1] did not meet it on 36 families (K4) and at registered power on 337 families -16.6 [-19.4, -13.8] did (realised one-sided error at the margin 1.8 to 3.2% per corner of a finite grid, nominal 2.5%, not a uniform-error guarantee; K4's status stands; K5, first ladder), while a second SecAlign++ adapter under the imposed Meta-SecAlign template did not (-11.8 [-14.3, -9.3]; K5, second ladder); no NOT-MET is a statement that the contrast was unchanged; their difference (+4.7 [+2.3, +7.2]) describes two fixed execution paths, licenses no superiority, equivalence or 'significant difference' claim; nothing follows from the statuses differing (K5). Intervals describe family-reweighting stability conditional on the execution, not reproducibility across engine executions; audit replays were neither substituted for nor averaged into outcomes; no missingness gate fired and directional completions changed no status.