The enterprise AI problem is shifting.
For the last year, most teams have worried about whether an AI system had enough context.
Now the bigger problem is that it may have too many plausible context sources at once.
OpenAI's current tools guide says model responses and agents can use built-in tools, function calling, tool search, file retrieval, and remote MCP servers. OpenAI's current file-search guide says models can retrieve information from uploaded knowledge bases through semantic and keyword search. Anthropic's current memory-tool docs say Claude can store and retrieve information across conversations in files that persist between sessions. Anthropic's current MCP docs say MCP is an open-source standard for connecting AI applications to external systems, including data sources, tools, and workflows.
That stack is powerful. It is also exactly why enterprises need an authority contract.
An authority contract is the operating record that names which source wins when memory, retrieval, user instruction, cached artifacts, and tool output disagree. It defines what counts as authoritative, what can only be advisory, how freshness is judged, what requires escalation, and what evidence must be preserved before the workflow moves forward.
Without that contract, AI systems do not just hallucinate facts. They can confidently choose the wrong truth from a pile of partly valid truths.
Why this matters now
The current product docs show that context assembly is no longer a single prompt plus a model.
OpenAI's tools guide now treats web search, file search, function calling, Programmatic Tool Calling, and remote MCP servers as normal parts of the workflow surface. Its file-search docs describe a hosted retrieval tool that can search uploaded files and automatically return output when the model decides to use it.
Anthropic's memory-tool docs describe cross-session memory that can create, read, update, and delete memory files that persist between sessions. The same page says memory supports just-in-time context retrieval rather than loading everything into the active context window at once. Anthropic's MCP docs describe a standard way to connect models to external systems, data sources, tools, and workflows.
Put those together and the operational picture changes fast. One run can see a user prompt, a system prompt, uploaded files, retrieved chunks, prior memory, a live tool result, and maybe a third-party MCP resource. If those inputs disagree, the model still has to choose what to trust.
The enterprise question is no longer only, "Can the AI find an answer?" It is, "Can the business prove the AI trusted the right authority when multiple answers were available?"
What actually conflicts in production
1. Memory versus system-of-record data
A model remembers that a customer prefers annual billing. The CRM now shows the account moved to monthly billing after a renewal. If memory wins, the next proposal is wrong even though the model "remembered" something real.
2. Retrieval versus current policy
File search pulls a high-scoring chunk from last quarter's pricing deck. A newer internal policy file or admin system has already changed discount thresholds. If retrieval wins without freshness and authority checks, the workflow turns stale knowledge into a live recommendation.
3. Tool output versus business approval state
A tool reports that an action is technically possible. That does not mean it is allowed. A shipping API may accept a reroute. A finance tool may accept a refund. A browser agent may find the right button. None of that proves the workflow crossed its approval gate.
4. User instruction versus governed workflow rules
A user says, "Just use the old template" or "ignore the missing field for now." If the workflow lacks a clear authority contract, the model may obey convenience over policy.
5. Local artifacts versus live external systems
An AI agent running on a workstation may see a local spreadsheet, a synced folder, cached notes, and a live SaaS tool. If nobody has defined which one is the real source of truth for dates, prices, approved language, or release state, the route becomes fragile the moment those sources drift apart.
Why a source-rich stack still needs a truth hierarchy
1. Tool-rich does not mean policy-aware
OpenAI's current tools guide is explicit that models can search the web, retrieve from files, load deferred tool definitions at runtime, call your own functions, or access third-party services through remote MCP servers. That is a capability expansion, not a built-in governance policy.
The platform can help the model reach more things. It cannot know which one your business treats as final authority for pricing, customer state, release readiness, approved messaging, project scope, or professional signoff.
2. Retrieval quality is not authority resolution
OpenAI's file-search docs say the tool retrieves from knowledge bases through semantic and keyword search. That is useful for finding relevant material. It does not mean the highest-scoring chunk is the newest, approved, or release-safe source.
Search solves relevance. An authority contract solves which relevant source gets to win.
3. Persistent memory makes drift more valuable and more dangerous
Anthropic's memory-tool docs say memory files persist between sessions and support just-in-time retrieval. That is powerful because the system can accumulate useful working context over time.
It is also dangerous if teams let memory outrank governed systems of record. Persistent memory should usually be treated as a convenience layer, not the final source for transactional facts, approvals, policy state, or regulated wording.
4. MCP makes context integration easier, not simpler
Anthropic's MCP docs describe a standard for connecting AI applications to external systems, tools, and workflows. That is good for interoperability. It also means one workflow can mix more external authority candidates in the same run.
Once a model can consult a database, a document store, a browser session, a SaaS API, and a memory file in the same job, the enterprise needs a written rule for which of those sources may overrule the others.
A practical authority ladder
| Source type | Typical role | What it should not silently overrule |
|---|---|---|
| Approved system of record | Final truth for current state, ownership, approval, and release status | Nothing below it without explicit exception handling |
| Current governed policy or run manifest | Rules for what the workflow is allowed to do | Cached templates, user shortcuts, or remembered habits |
| Fresh retrieved documents | Context, support, and evidence | Current system-of-record fields or approval state |
| Tool output | Live observation or execution result | Business authority if the action still needs approval or reconciliation |
| Persistent memory | Convenience, preferences, working notes, and continuity | Approved records, policy, or current transactional state |
| User free-text instruction | Intent and task framing | Governed workflow policy, required evidence, or blocked actions |
The exact ranking depends on the workflow. The point is not that one universal order fits every business. The point is that the order must be named before the AI is trusted with real work.
What an authority contract should include
1. Ranked source classes
Name the source categories the workflow can use and rank them. Separate system-of-record data, policy artifacts, retrieved documents, live tool results, memory, and user instructions.
2. Freshness policy
Define how recent a source must be before it can influence action. Some records are current-state authorities. Others are historical context only.
3. Conflict rules
State what happens when sources disagree. Does the workflow stop? Ask a human? Re-query a tool? Mark the answer provisional? Write that down.
4. Writeback authority
Decide which source may be updated by the workflow and under what approval boundary. Reading and writing should not share the same trust assumptions.
5. Evidence requirements
Require the workflow to preserve the exact authority source that drove the final answer or action. A nice summary is not enough if reviewers cannot see what won.
6. Memory boundaries
State what memory may store and what memory may never be treated as final authority for. Preferences and continuity notes are different from controlled business records.
7. Escalation triggers
Define which contradictions force human review. Examples include approval-state mismatch, pricing mismatch, identity mismatch, revision mismatch, or policy mismatch.
8. Release-safe language
For any customer-facing or externally consequential workflow, define which approved source controls final language, disclaimers, and commitments.
Three examples operators can use immediately
Sales operations
If the AI drafts an account brief, the CRM should usually outrank memory for current deal stage, owners, and billing terms. Retrieved call notes can add context. They should not silently replace approved system fields.
Private AI support desks
If a local assistant can read runbooks, incident notes, and prior tickets, the current production-status system should outrank cached markdown or memory when a user asks whether a service is healthy right now.
AEC and technical review
If an AI-assisted review workflow sees old PDFs, a current sheet index, a comment log, and remembered project preferences, the current issued revision and licensed-human approval state should outrank older retrieved document fragments or convenience memory. That does not make the AI a professional authority. It makes the workflow honest about where authority still lives.
Questions buyers and operators should ask
- Which exact source wins when memory conflicts with the system of record?
- Can the workflow distinguish fresh approved policy from relevant but stale retrieved text?
- Does tool success prove business approval, or only technical reachability?
- What evidence shows which source actually drove the final answer or action?
- Which contradictions force escalation instead of silent synthesis?
- Can the team explain the authority order in one page without improvising?
If the team cannot answer those questions, the workflow may have rich context but weak governance.
The commercial takeaway
Enterprise AI maturity is no longer just about model quality or retrieval quality.
It is about authority quality.
The next wave of failures will not always look like classic hallucinations. Many of them will look like polished outputs built from the wrong source winning a quiet conflict.
That is why a serious AI workflow needs more than memory, tools, and search. It needs a visible authority contract that says which truth counts, when contradiction blocks progress, and how reviewers can verify the choice after the run.
If an AI workflow cannot name which source outranks memory, retrieval, and tool output when they disagree, it does not fully control the work it is automating.
Related reads
- Enterprise AI Memory Is a Retention Policy: The Governance Layer for Persistent Assistants
- Enterprise AI Needs a Freshness Layer: The Retrieval Policy Between Search and Action
- Enterprise AI Needs a Citation Contract: Why Source Links Alone Do Not Make AI Answers Safe to Use
- Private AI Needs a Working-Directory Contract: Why Local Agents Turn the Filesystem Into a Governance Boundary