Source Lineage: The Foundation of Trustworthy AI Memory

There's a particular kind of AI failure that's worse than a wrong answer: a confidently delivered claim that turns out to have no source.

The model said "the team decided to deprecate the v1 endpoint." Where did that come from? No one can find the decision. Maybe it was in a Slack thread someone deleted. Maybe it was in a hallucinated memory the AI confabulated. Maybe it was in a stale memory from six months ago that should have been retired.

Without source lineage, you cannot tell the difference.

What lineage actually requires

Every memory in Memplex carries:

• Source link — a URL or path to the artifact this memory came from. Paragraph-level granularity where the source format supports it (e.g., a specific block in a Notion doc, a specific line range in a code file, a specific message in a Slack thread).
• Confidence score — how strongly the extraction process believed this memory accurately reflects the source. Re-computed on review.
• Lifecycle state — where this memory sits in its review process: raw, extracted, suggested, accepted, verified, pinned, or revoked.
• Review history — who reviewed it, when, and what they changed.
• ACL inheritance — the access controls from the source, mirrored onto the memory. If the source becomes inaccessible, the memory becomes inaccessible.

This is a lot of metadata per memory. It is also the difference between a guessing machine and a system of record.

Lifecycle states explained

Most memory systems treat memories as a single tier — once it's in, it's in. Memplex doesn't.

• Raw — the memory exists in the source but hasn't been parsed yet.
• Extracted — the parser has produced a structured representation, but no one has confirmed it.
• Suggested — the system thinks this is a meaningful memory worth surfacing, but it's still provisional.
• Accepted — a user or process has acknowledged the memory as correct.
• Verified — explicitly checked against the source recently.
• Pinned — manually elevated to "always include if relevant."
• Revoked — the memory has been retired (incorrect, outdated, or removed from source).

Retrieval can filter on lifecycle state. "Only show me verified memories from sources I've reviewed in the last 30 days" is a valid query, and one that an enterprise user might run before letting an AI agent act on context.

ACL inheritance is non-negotiable

A common shortcut in AI memory products: ingest everything, store it in your own database, lose track of who could see what in the original source.

This is a privacy bomb. It means a user who lost access to a Slack channel six months ago can still query AI memory that surfaces content from that channel. It means a contractor who was removed from a project can still see memories derived from that project's docs.

Memplex inherits ACLs from the source at ingestion time and revalidates at retrieval time. If you can't see the source artifact right now, you can't see memories derived from it. Period. The source remains the system of record for who's allowed to see what.

Why this matters for adoption

Enterprises do not adopt AI memory systems they can't audit. They cannot adopt them. Their compliance teams won't sign off. Their legal teams won't sign off. Their security teams won't sign off.

The path to enterprise isn't a special tier with extra features. It's an architecture where lineage and ACL inheritance are built in from day one. Then the audit story writes itself: every memory has a source, every retrieval has a trace, every access has a revalidated permission check.

We built Memplex this way from v0 not because we have enterprise customers yet, but because retrofitting trust is hard and shipping with it is easy. Most companies eventually need this; few build it from the start.