Four Governance Invariants for Organisational Agent Memory: A Specification

Agent memory is moving from the single user to the organisation: several people, several nodes, one shared recollection. That move turns former product decisions into properties that must hold structurally, because a user of an organisational memory can be harmed by what the memory reveals as much as by what it forgets. This note specifies four invariants for that setting, and for each the obligation a system must discharge to claim it: (1) existence-oracle-free cross-node recall — an unauthorised record must not be inferable, pinned by three equalities between the authorised view and the ground-truth view (result count, latency, audit-chain form), with byte-identity of results a fourth, separately established property; (2) transitive multi-hop erasure, completion shown by a proof of absence rather than asserted by a receipt; (3) co-determination as a fail-closed architectural invariant — exactly one oversight record, written before delivery, classification failing closed; (4) contradiction-preserving attributed organisational memory — conflicting statements kept both, attributed, with per-user erasure that spares co-authors. Invariants 1 and 2 have classical ancestors; offered here is their combination and formalisation for this setting, not their invention.