A security team is preparing an audit report. The agent retrieves an internal procedure that permits server names in an executive summary. That procedure belongs to an earlier engagement with a different scope and different recipients. The current report describes sensitive systems and must remain within an authorised group. Successfully retrieving a document can therefore support an unjustified disclosure.
The risk extends beyond fabricated information. An authentic source can be applied to the wrong client, environment, version or authority. Document retrieval alone does not establish those conditions.
What I call level 2
In my maturity framework for AI use, level 2 organises the work context: objectives, resources, constraints, decisions and useful sources. It extends the isolated interaction of level 1. This personal framework examines responsibilities; it is not a certification standard.
Context can come from project instructions, documentation or a retrieval system. Its presence establishes neither complete reading nor correct application. Loading and memory mechanisms vary between products. The relevant question is what the instance actually receives for the particular task.
Anthropic’s account of context engineering examines selecting useful information within limited capacity. Selection must also retain the conditions that make a source applicable.
A relevant source does not confer authority
Our audit requires an identified engagement, authorised recipients, the applicable procedure and the report’s restrictions. The earlier document may explain a method. Semantic similarity to the request cannot, on its own, authorise publication of system names.
Context informs a decision; it does not automatically transfer the permissions of its original situation.
Careful preparation retains the source, version and scope. A contradiction with a current rule must remain visible. If authority to disclose is unestablished, sensitive delivery stays pending while analysis continues within the authorised scope.
A lean index linked to specialised references consulted when needed supports this organisation. Its owner must decide updates and withdrawals. Accumulating files without resolving their contradictions can increase text volume while weakening the decision.
What RAG actually changes
RAG can supply the model with passages retrieved from a corpus at request time, including documents absent from its training. It guarantees neither corpus freshness, correct passage selection nor a sound interpretation.
Retrieving the obsolete procedure faster does not resolve its scope mismatch. Its status, provenance, disclosure restrictions and relationship to the current question still require examination. The absence of a qualified reference must remain part of the record.
Where Swarm fits
Swarm separates context references from execution conditions. Its historical-memory Rust path retains file references associated with the work and rechecks their availability and containment within the project before execution permissions. These references are not automatically complete prompt content and do not guarantee file freshness until consumption.
Finding a path, reading its bytes, assessing its content and authorising a disclosure are different operations. Confidentiality and integrity contracts add other boundaries whose cross-cutting integration remains partial. A present reference does not establish end-to-end protection.
Level 3 adds an explicit method for examining those elements. Level 6 then asks how the relevant controls are enforced before action. The Swarm source makes this relationship examinable without equating available context with a justified decision.