Not all memory writes carry the same risk. A stored fact like "the user prefers metric units" has negligible security impact if wrong. A stored entry like "this account has billing authority without manager approval" can cause immediate financial harm.

What triggers human review: Any memory entry that encodes an authorization, permission, exception to policy, role assignment, or behavioral rule should be flagged for human review before being written to the store. The review presents the proposed entry, its intended source, and the reasoning for storing it. A human approves or rejects — no automated bypass.

Why this matters especially for ingestion: The indirect ingestion channel (Type 4) is particularly dangerous because the content is processed automatically without human involvement. Inserting a human review step for any entry the ingestion pipeline classifies as policy-like or authorization-like breaks the fully-automated poisoning path.

The most architecturally impactful control is separating memory into tiers with different write privileges:

Curated knowledge tier (read-only to agents): Documents, product specs, verified policy documents, approved knowledge base entries. Written only by humans through an admin interface. Agents can retrieve from this tier but cannot write to it — ever. A prompt injection attack cannot corrupt the curated knowledge base because agents have no write path to it.

Episodic / derived tier (agent-writable, human-reviewable): Session summaries, extracted facts from processed documents, user-stated preferences. Agents can write here, but subject to the validation rules in MIT01 and the TTL policies in MIT04. Human administrators can audit and purge this tier without affecting the curated knowledge base.

The key property: An attacker who fully compromises an agent's ability to write to episodic memory still cannot corrupt the curated knowledge base. The damage is contained to the more volatile tier.