Operate when content attempts to enter memory. MIT01 (input validation) filters malicious content before it's stored. MIT02 (source provenance) tags everything with its trust level at write time. MIT03 (access controls) restricts who can write where. MIT05 (human review) inserts a person into the write path for high-stakes entries. MIT06 (tier separation) makes the curated knowledge base physically inaccessible to agent writes.

These controls prevent poisoning from happening. When they work, there is nothing to detect or recover from.

Operate on what's already in memory before it gets retrieved. MIT04 (TTL) limits how long any entry can persist — so a poisoning event that evades write-time controls has a bounded window of impact. MIT08 (audit logging) creates the record that makes anomalous writes detectable after the fact. MIT09 (periodic review) actively hunts for poisoned entries that passed initial validation.

These controls limit damage duration and enable detection and recovery.

Operate when memory is retrieved and used. MIT07 (reduced trust for retrieved content) reduces the impact of any poisoned entry that survives to retrieval — by instructing the agent to treat retrieved authorization claims skeptically rather than accepting them as ground truth. MIT02 also operates here — surfacing provenance metadata so the agent knows whether the retrieved entry came from a trusted source.

This layer is the last line of defense: it reduces the harm from entries that evaded all earlier controls.