The Usual Storage Defaults Break
Databases still assume a human types the INSERT statement, where a person writes a fact that another person reads later, and if the fact is wrong, an admin deletes it during a cleanup script. Agents don't work like this. They run fast and draft facts continuously, deciding to write hundreds of records per second based on unstructured text they parsed seconds ago. Knowledge graph stores carry defaults set when humans curated them, which means they accept writes now and clean later, keep one time axis or none, treat every writer's facts as equally trustworthy, and leave governance to dashboards and middleware (source). These defaults fail under agent workloads.
A single agent running a retrieval loop might generate dozens of conflicting facts about the same entity in a few seconds. If the storage layer only tracks when the fact was written, you overwrite history. When the storage layer treats an anonymous scraping agent with the same trust as a verified internal API, you poison the graph. The cleanup script approach assumes a human catches the anomaly during a scheduled review window, but agents generate too much volume for a human to review. The database needs to reject bad writes at ingestion time based on trust scores, or you accept the graph degrades into noise over time.
Bitemporal Writes and Trust Weights
Bitemporal data modeling tracks two time intervals, logging when an event actually occurred and when the database recorded the event. For human data entry, the gap between these two times is usually minutes. For agents scraping web pages or parsing logs, the source data might be weeks old. If an agent reads a log from last Tuesday and writes a fact today, a single-axis timestamp destroys the context. You need the database to hold both times natively, which lets you query the graph as it existed at a specific point in time, filtering out facts the agent gathered later but that originally belonged to a previous state.
Quipu is an embeddable store built to handle this exact problem (source). It tracks bitemporal time and assigns trust weights to individual facts. Trust weights decay over time or drop based on the source quality. An agent drafting a summary from a low-traffic forum receives a lower trust score than an agent reading from an official vendor advisory. The database rejects low-trust writes outright or stores them as low-confidence edges, allowing you to filter the graph by confidence thresholds at query time instead of running cleanup scripts after the graph is saturated with garbage.
Storing trust weights changes the query engine. A standard graph query looks for all edges connected to a node, whereas a trust-weighted query evaluates the minimum confidence threshold required for the specific task and filters edges below that threshold before returning results. This adds compute overhead to reads, trading raw read speed for data quality. When security agents query the graph for threat indicators, they request high-confidence edges only, skipping the noise generated by speculative enrichment agents. Research agents exploring broad connections accept a lower threshold to pull in more data. The application layer sets the threshold, and the database executes the filter.
Handoffs and Reference Layers
Agents don't just write to storage, as they hand data to other agents. In distributed agent systems, one agent runs an extraction task and passes thousands of tokens of context to the next agent in the chain. Pasting the full context into a prompt wastes space and breaks the state if the next agent needs to run asynchronously, so you need to pass a reference.
Waggle provides attributed, resolvable artifact references for agent handoffs (source). It uses a roughly 30-byte token to point to an artifact instead of pasting the context directly. The first agent writes the data to storage, gets the token back, and passes the token to the next agent. When the second agent resolves the token, it reads the data natively, keeping the context window clean and preserving provenance.
This approach is MCP-native, as MCP standardizes how agents discover and interact with external data sources, meaning a reference layer that fits into MCP allows agents to pass artifacts without custom integrations. The token carries the attribution metadata inside it, so you can trace exactly which agent drafted the artifact and what source it pulled from. If an agent hands off a 30-byte token instead of a massive text blob, the receiving agent spends less time processing the prompt and more time running the task. The receiving agent avoids hallucinating context because it reads the exact artifact stored in the database rather than a summarized version passed through a prompt.
Tracing Influence in Outputs
Storage and handoffs solve the ingest and transfer problems, though you still need to trace how retrieved facts change the final output of a model. In security operations, analysts need to know if a model is hallucinating an attack pattern or if it pulled the pattern from a verified log. Trust in generated outputs is a main criteria for deployment in cybersecurity operations (source). A model that cannot prove where its facts came from is useless for incident response.
Topological Attribution Distance measures how specific retrieved documents change the vector geometry of the final output (source). It looks at how segments of retrieved text shift the embeddings of the model response, providing segment-level provenance. You can point to a specific paragraph in a model output and map it back to the specific chunk in the knowledge graph that caused it.
If an agent decides to flag an IP address as malicious, TAD shows which graph edge drove that decision. If the graph edge points back to a low-trust write from a scraping agent, you know to verify the alert manually before paging an on-call engineer. If the edge points back to a high-trust write from a verified feed, you can automate the response. This ties the storage trust weights directly to the output evaluation. The database knows the trust score, and the retrieval layer knows which edges it pulled. The attribution layer then determines how those edges shaped the final tokens.
Tying these layers together gives you a full chain of custody. The agent reads a source, then writes a fact to the graph timestamped bitemporally and weighted by the source quality. A retrieval agent pulls that fact so a generator agent can use it to draft a response. The TAD measurement confirms the fact influenced the output, removing the guesswork from agent pipelines. You query the graph to verify the chain of custody.
FAQ
Frequently asked questions
What is bitemporal data modeling?
Bitemporal data modeling tracks two intervals. One is the exact time an event happened. The database also logs its own ingestion moment for that same event. Agents don't record events at the exact moment they happen, so keeping these separate lets you query the graph as it existed historically.
How do you handle bad facts from agents?
A database has to reject bad writes at ingestion time using trust scores. An agent scraping a low-traffic forum gets a lower score than one reading an official advisory. You don't run cleanup scripts later because the query engine filters edges based on a minimum confidence threshold. Security agents request high-confidence edges to skip speculation.
How do agents pass context to each other?
Agents pass context by writing data to storage and handing over a reference token. Waggle uses a 30-byte token pointing to that stored artifact. The receiving agent resolves the token and reads the data natively. You don't need custom integrations because this approach fits into Model Context Protocol.
How can you trace where a model gets its facts?
Topological Attribution Distance measures how retrieved documents change the vector geometry of an output. It looks at how text segments shift the embeddings. This segment-level provenance maps a specific paragraph in the response back to the graph chunk that caused it. Analysts don't have to guess which edge drove a decision.