EVIDENCE & LIMITS · DESIGN NOTE
Context Is Not Invisible Memory
A secure sign-in can establish an authorization flow. It does not decide which parts of a person’s history belong in a new conversation.
Authentication is not a conversational permission slip
OAuth security guidance is about protecting redirects, clients, tokens, and resource access. The Model Context Protocol authorization specification similarly describes how a client discovers protected-resource and authorization-server information. Those are necessary security building blocks, but neither standard decides whether a prior note, profile field, or result is relevant to a new reflective exchange.
For a reflective product, “the person signed in” is therefore not enough to answer “what may be read now?” That second question needs an understandable, session-specific boundary.
Make the context boundary inspectable
Noesis proposes a visible session brief when additional context could help. The brief should distinguish the current conversation from user-selected recent notes, a named-theme search, a profile summary, and a full transparency view. A person should be able to correct the brief before it affects the next question.
This is a design proposal, not an announcement that a named AI client has accepted or enforces the pattern. A host must be evaluated at its exact version and surface before it can be described as supported.
Ask for the smallest useful source
A request about the past week may justify a bounded recent-notes read. A request about one named theme may justify a scoped search. Neither request automatically justifies a full-history sweep. The requested source, purpose, and scope should be visible before a read and should be available for the person to revise.
Retrieved material must also remain data. It may contain language that resembles an instruction, but it must not become instruction for the assistant merely because it was stored earlier.