Artificial intelligence is very good at sounding as though it knows.

It can summarise a long history in seconds.

It can identify patterns.

It can produce a confident sentence from incomplete evidence.

It can turn three observations into a theory.

It can repeat an old explanation with such fluency that nobody notices the explanation is no longer current.

In ordinary software, this may be inconvenient.

In care, it can be dangerous.

An Amanah Companion may eventually help preserve communication, sensory support, routines, health references, care handoffs, preferences, relationships, and person-specific ways of navigating the world.

But before it is allowed to say:

“I know what helps.”

it must be able to answer:

What kind of knowledge is this? Where did it come from? Who confirmed it? How certain is it? In which setting did it apply? Is it still current? Who may change it? What happens if the person disagrees?

A care system should not merely store information.

It should preserve the epistemic status of that information.

That is the difference between a continuity spine and a memory pile.

Memory is not one thing

The first Amanah series already separated care memory from surveillance.

It argued that useful continuity should be selective, purpose-bound, source-traced, reviewable, and human-governed.

The later architecture sharpened this into a typed Care Memory Ledger.

That direction is essential because “memory” can refer to radically different things.

A person’s direct expression is memory.

A parent’s observation is memory.

A clinician’s recommendation is memory.

A teacher’s incident note is memory.

A machine-generated pattern is memory.

A current routine is memory.

A childhood routine is memory.

A shared joke is memory.

A safety rule is memory.

A sensor log is memory.

A device fault is memory.

These items should not carry equal weight.

They should not be retrieved in the same way.

They should not remain active for the same length of time.

They should not be visible to the same people.

And they should not all be allowed to influence action.

The system needs to know not only what the record says, but what kind of record it is.

The six questions behind every important record

Every consequential Amanah record should be able to answer at least six questions.

1. What is being claimed?

The content itself.

For example:

“Loud hand dryers may cause distress.”

2. Who or what produced the claim?

The source.

For example:

• the person;
• a parent;
• a support worker;
• a teacher;
• a clinician;
• a therapist;
• a sensor;
• or an AI model.

3. How was it produced?

The method.

For example:

• direct expression;
• observed event;
• professional assessment;
• imported record;
• repeated pattern;
• machine inference;
• or approved care review.

4. In which context did it apply?

The setting and circumstances.

For example:

• one particular shopping centre;
• public toilets generally;
• a period of illness;
• a noisy school day;
• only when the person was already overloaded;
• or only with one specific device.

5. What is its current status?

For example:

• raw observation;
• person-confirmed;
• professionally verified;
• approved support;
• disputed;
• uncertain;
• superseded;
• expired;
• or withdrawn.

6. What may this record authorise?

Perhaps nothing.

A record can inform a question without authorising an action.

A machine inference may justify human review.

It should not automatically become permission to act.

A person’s expression is not a caregiver note

Consider these three records:

“Umar selected the stop symbol when the music began.”

“His mother believes the music was too loud.”

“The AI detected a possible association between music onset and distress.”

All three may concern the same event.

They are not the same kind of knowledge.

The first is a person expression captured through a communication channel.

The second is a human interpretation.

The third is a machine-generated hypothesis.

Amanah should preserve all three separately.

It should not rewrite them into:

“Music causes distress.”

That final sentence may be true.

It may also be too broad.

Perhaps the volume mattered.

Perhaps it was one song.

Perhaps the person was already tired.

Perhaps the speakers created vibration.

Perhaps the selection meant “stop this activity” rather than “music is always harmful.”

Perhaps the person later chose music willingly in another context.

The system should help humans investigate without promoting uncertainty into permanent fact.

The evidence ladder should not become a rigid ranking

The earlier Amanah architecture proposed an authority or evidence ladder.

That was useful because it prevented machine observations from outranking person-confirmed knowledge.

But a universal numerical ranking would be too simple.

Evidence is not strong merely because it comes from a professional.

A clinician may be working from incomplete information.

A parent may recognise a pattern invisible during a short appointment.

A person’s present expression may conflict with an old assessment.

A direct expression may be ambiguous.

A sensor may accurately report movement without explaining its meaning.

An AI may identify a genuine pattern while still being unable to establish cause.

So Amanah should not encode:

clinician = 100
parent = 80
person = 70
AI = 20

That would turn context into arithmetic.

Instead, each record should preserve several dimensions:

• authorship — who produced it;
• directness — direct expression, observation, interpretation, or inference;
• expertise — what relevant competence the source has;
• context fit — whether the source was present in the relevant setting;
• recency — whether the claim is current;
• repeatability — whether similar events occurred;
• confirmation — whether the person or another qualified source confirmed it;
• uncertainty — how much remains unknown;
• coercion risk — whether the expression may have been shaped by pressure;
• conflict — whether other evidence disagrees;
• scope — how narrowly or broadly it should apply;
• and authority — whether it may inform, recommend, approve, or execute anything.

The point is not to calculate one perfect truth score.

It is to prevent the system from hiding how it arrived at a claim.

Provenance is care infrastructure

In publishing, provenance protects authorship.

In technical systems, provenance helps track where data came from and how it changed.

In Amanah, provenance becomes part of care safety.

The World Wide Web Consortium’s PROV model provides a general vocabulary for representing entities, activities, agents, and the relationships through which information is generated or derived.^[1]

HL7 FHIR applies similar provenance concepts in health information exchange. Its Provenance resource is designed to record who, what, and when for a set of resources, supporting authenticity, trust, and traceability.^[2]

Amanah does not need to copy either model uncritically.

But the underlying principle is exactly right:

A record should carry its history with it.

That means Amanah should be able to show:

• who created the record;
• who supplied the underlying information;
• which model transformed or summarised it;
• which documents were used;
• which fields were edited;
• who reviewed it;
• which version became active;
• what it replaced;
• and what later replaced it.

Without provenance, a machine-generated sentence can become indistinguishable from a person’s own expression.

That is unacceptable in care.

Observation, interpretation, and inference

Amanah should separate at least three stages.

Observation

What was directly seen, heard, selected, measured, or recorded?

For example:

“At 10:14, the person covered both ears after the hand dryer started.”

Interpretation

What did a human think the observation might mean?

For example:

“The support worker interpreted this as sensory discomfort.”

Inference

What pattern or explanation was produced from one or more observations?

For example:

“Amanah detected three similar events involving high-frequency mechanical noise and suggests reviewing whether this is a recurring sensory trigger.”

These stages should not collapse into one another.

A system that stores only the inference loses the evidence beneath it.

A system that stores only raw observations forces every future human to reconstruct meaning from scratch.

A good continuity spine keeps the chain visible.

The person can confirm, reject, or change the record

Amanah should not only collect knowledge about the person.

It should provide ways for the person to respond to that knowledge.

Depending on communication access, the person may:

• confirm;
• reject;
• correct;
• narrow;
• expand;
• defer;
• hide;
• request review;
• or mark something as no longer true.

For example:

Record: “Prefers dim lighting.”

The person may later communicate:

“Only when tired.”

That is not a contradiction to erase.

It is a refinement.

Or:

Record: “Does not tolerate headphones.”

The person may later choose a different type of headphones successfully.

The older record should not disappear without trace, because its history may matter.

But it should stop operating as the current rule.

The continuity spine needs supersession.

Supersession is better than silent editing

When care information changes, the system should not simply overwrite the old sentence.

If a record is silently edited, nobody knows:

• what changed;
• why;
• who changed it;
• whether the previous version was wrong;
• whether it still matters historically;
• or which decisions relied upon it.

Amanah should support versioned records.

For example:

Version 1

“Bath transition is usually difficult when tablet use ends abruptly.”

Source: parent observation
Status: approved support rule
Created: 2026-02-10

Version 2

“Abrupt tablet removal is one trigger, but difficulty is greater when the bath follows a long school day. Offer a five-minute warning and check fatigue.”

Source: parent + support worker observations
Status: revised after review
Created: 2026-06-22
Supersedes: Version 1

Version 3

“The person now chooses whether to use a timer or finish the current activity first. Do not assume the previous routine remains preferred.”

Source: person-confirmed preference
Status: current
Created: 2028-09-04
Supersedes: Version 2

This preserves continuity without freezing the person.

Expiry is an epistemic feature

Expiry is not only an access-control mechanism.

It is also a statement about knowledge.

Some records should be reviewed because time changes their reliability.

A current medication list can become unsafe when outdated.

A school support may no longer apply after leaving school.

A childhood communication pattern may change.

A temporary fear after a medical procedure may resolve.

A preferred carer may leave.

A risk condition may pass.

A person may develop a new skill.

An old sensory support may become irritating.

Amanah should therefore distinguish:

• permanent historical record;
• current active support;
• time-limited instruction;
• event-specific note;
• temporary hypothesis;
• and scheduled review item.

The system should not treat “stored” as synonymous with “still true.”

Relational memory has a different epistemic status

Relational continuity cannot be handled exactly like clinical information.

Suppose the person has a familiar phrase used by their mother before an appointment.

The phrase matters because of the relationship, not merely because the words have a calming effect.

A record might preserve:

• the phrase;
• who used it;
• the circumstances;
• the person’s response;
• and whether the person still wants Amanah to use or remember it.

But the system should not convert that into:

“Phrase X reduces anxiety by 42%.”

That would flatten relationship into behavioural optimisation.

Relational memory should carry meaning, consent, history, and ownership.

It should not become a hidden engagement profile.

It should also be able to acknowledge loss.

If a parent dies, the system should not continue using the parent’s voice or manner as though nothing happened unless the person has made a clear, informed choice within a carefully governed design.

Relational continuity is not impersonation.

It is the preservation of chosen meaning.

Machine hypotheses must remain hypotheses

An AI may detect patterns that humans missed.

This could be useful.

For example:

“Difficult evenings appear more common after days with multiple unexpected transitions.”

That may help the care circle ask better questions.

But the system must retain the correct label:

candidate pattern

not:

care fact

A machine-generated hypothesis should include:

• the data sources used;
• the time range;
• missing data;
• relevant context;
• confidence or uncertainty;
• possible alternative explanations;
• population limits;
• and the human review required before it affects care.

It should not silently enter the Care Profile.

It should not be used to justify restraint, medication, reduced opportunity, or a change in legal authority.

It should not be phrased as diagnosis.

It should not be presented as the person’s own view.

This is where NIST’s AI Risk Management Framework is relevant. The framework treats AI risk management as a continuous process of governance, mapping, measurement, and management, with attention to validity, reliability, transparency, accountability, privacy, safety, and harmful bias.^[3]

Amanah will need more specific controls than the general framework provides.

But the posture is correct:

An AI output is not trustworthy because it exists. It must be evaluated within its context of use.

Confidence labels are necessary but insufficient

Amanah may label an inference:

• low confidence;
• medium confidence;
• high confidence.

That helps, but confidence alone can mislead.

A model may be highly confident and wrong.

A pattern may be statistically strong but ethically irrelevant.

A record may be reliable in one setting and useless in another.

A clinician may be confident because they have not seen the contradictory home evidence.

A parent may be certain because a pattern repeated for years, even though the person has recently changed.

So Amanah should display not only confidence, but the basis of confidence.

For example:

Candidate pattern: abrupt task changes may increase distress.
Basis: 6 caregiver notes across 4 weeks.
Missing: no school observations; no direct person confirmation.
Alternative explanations: fatigue, pain, noise, hunger.
Required next step: review with the person and care circle before activating any support rule.

That is much more useful than:

87% confidence.

Professional recommendations need scope

Professional input can be vital.

A speech-language therapist may recommend an AAC access method.

An occupational therapist may identify sensory or motor accommodations.

A physician may document a health risk.

A psychologist may provide an assessment.

But professional recommendations should still be scoped.

A recommendation should record:

• the professional’s verified role;
• the date;
• the relevant domain;
• the assessment method;
• the person’s participation;
• the intended setting;
• contraindications or limitations;
• review date;
• and whether the recommendation is advisory, required, or legally binding in that jurisdiction.

Amanah should resist a common institutional drift:

One professional note becomes a universal life rule.

A recommendation made for a hospital visit may not belong in a classroom.

A school intervention may not belong at home.

A childhood assessment may not define adulthood.

A diagnosis may support access without becoming identity.

The professional remains responsible within their role.

The system should not inflate that role.

Raw logs are not care memory

A device may generate enormous quantities of data.

Movement.

Location.

Audio events.

Environmental conditions.

App usage.

Button presses.

Sleep estimates.

Heart rate.

Task completion.

Interaction duration.

Sensor errors.

Most of this should not automatically enter care memory.

The fact that data exists does not mean it deserves to be preserved.

Amanah should ask:

• What care purpose does this serve?
• Is the data necessary?
• Could a less invasive measure achieve the same goal?
• Who consented or authorised collection?
• Can the person understand or inspect it?
• How long is it retained?
• Who can access it?
• Will it be used for model training?
• Could it be used to score compliance?
• What harm occurs if it leaks?
• Can the person turn it off?
• What happens when it is deleted?

The original Amanah doctrine was correct to reject continuous behavioural capture and training-data extraction.

A life should not become raw material merely because sensors can record it.

The right record is sometimes no record

A care system can become obsessed with documentation.

Every refusal.

Every delay.

Every movement.

Every difficult moment.

Every successful task.

Every interaction.

This can produce the illusion of safety while creating another form of harm.

The person begins to live inside a permanent report.

Staff may stop seeing change because the historical record feels authoritative.

A future employer, clinician, or service may encounter years of difficulty before encountering one line about interest, humour, skill, love, or preference.

Amanah therefore needs deletion, minimisation, and non-capture as real design options.

Some information should never be collected.

Some should remain local to one device.

Some should expire.

Some should be summarised and then deleted.

Some should remain person-private.

Some should be recorded only as:

support offered and declined

without storing intimate detail.

The right to continuity is not a duty to become endlessly legible.

Uncertainty should be visible

Care systems often hide uncertainty because uncertainty looks unprofessional.

But false certainty is more dangerous.

Amanah should be able to say:

• “This is unclear.”
• “The person’s expression was ambiguous.”
• “Two sources disagree.”
• “This pattern has not been confirmed.”
• “The current record may be outdated.”
• “The model did not receive enough context.”
• “The professional recommendation applies only to one setting.”
• “No one has reviewed this in six months.”
• “The person’s present response conflicts with the approved plan.”
• “This action should pause.”

Uncertainty is not failure.

It is information.

A system that cannot represent uncertainty will manufacture certainty from whatever it has.

What Amanah should never claim to know

There are several claims an Amanah Companion should approach with extreme restraint.

It should not say:

“I know what the person really wants.”

It should say:

“This is the person’s recorded expression in this context,”

or:

“This may indicate refusal; clarification is required.”

It should not say:

“This behaviour means manipulation.”

It should say:

“These events occurred; possible explanations remain under review.”

It should not say:

“The person lacks capacity.”

That is a legal and clinical conclusion governed by jurisdiction-specific processes, not a model classification.

It should not say:

“This treatment will work.”

It may retrieve a verified recommendation and state its source.

It should not say:

“The parent is wrong.”

It may show that current person expression conflicts with an older parental record.

It should not say:

“The person has changed permanently.”

It may show that the current pattern differs from the previous one.

It should not say:

“I remember everything.”

Amanah should know what it holds, what it does not hold, and what it is not entitled to hold.

A knowledge-state model for Amanah

Amanah may eventually need an explicit set of knowledge states.

For example:

Person expressed

The person directly communicated something through an identified channel.

Person confirmed

The person later confirmed an interpretation or record.

Person disputed

The person rejected or corrected a record.

Human observed

A human recorded an event without claiming final meaning.

Human interpreted

A human proposed an explanation.

Professionally assessed

A qualified professional made an assessment within scope.

Approved support

The relevant authority path activated a support rule.

Machine detected

A sensor or model identified a signal or pattern.

Candidate hypothesis

A possible explanation awaiting review.

Conflicted

Relevant sources disagree.

Uncertain

The evidence is insufficient.

Superseded

A newer version has replaced the record.

Expired

The record is no longer active.

Historical only

The record remains for continuity but should not drive current action.

Withdrawn

The person or authorised source withdrew the record or permission.

This is not necessarily the final vocabulary.

But Amanah needs something like it.

Without explicit states, every sentence in the database starts to look equally true.

The audit trail must include transformations

Suppose a caregiver writes:

“He cried before bath after the tablet was taken.”

An AI transforms it into:

“Possible transition difficulty related to abrupt tablet removal.”

A reviewer approves:

“Use a five-minute visual timer before bath.”

Later, another support worker adds:

“He chose to finish the video first and entered the bath calmly.”

Then the person begins using an AAC option to choose between:

• timer;
• finish current activity;
• or bath later.

The audit trail should preserve this evolution.

It should show:

1. raw observation;
2. machine interpretation;
3. human review;
4. approved support;
5. later evidence;
6. person participation;
7. revised rule;
8. supersession of the old rule.

That is not merely logging.

It is a history of how the care system came to believe what it believes.

Portability requires provenance

Amanah aims to preserve continuity across models, devices, institutions, and potentially physical bodies.

That cannot be done safely by exporting plain text alone.

A new system should not receive:

“Avoid public toilets.”

It should receive the structure behind the sentence:

• source;
• date;
• setting;
• observed trigger;
• person response;
• confidence;
• current status;
• review date;
• relevant permissions;
• and what actions the information may support.

Otherwise portability becomes context loss.

The new model may treat a narrow observation as a universal prohibition.

The new device may act on stale information.

The new institution may misunderstand who authored the record.

Provenance is therefore what allows continuity to move without becoming distortion.

What the prototype should demonstrate

A first Amanah prototype should not try to prove that AI knows a person.

It should prove that the system can handle knowledge responsibly.

A synthetic demonstration could show:

• one person expression captured through AAC;
• one caregiver interpretation;
• one professional recommendation;
• one machine-generated hypothesis;
• conflicting evidence;
• a review workflow;
• an approved support;
• a later person correction;
• supersession of the old support;
• an expired school record;
• a context-limited export;
• a model transfer;
• and an audit view showing the full chain.

The success question is not:

Did the AI predict the person correctly?

It is:

Did the system preserve source, uncertainty, authority, context, revision, and person participation without turning a hypothesis into care law?

That is a much more responsible first test.

Knowledge under amanah

The Arabic word amanah carries the sense of trust, responsibility, and something placed in one’s care.

Knowledge about a vulnerable person is an amanah.

It can protect.

It can preserve communication.

It can prevent repeated harm.

It can help a new carer understand.

It can reduce the burden on a parent who has carried the whole map alone.

It can help a clinician see what one short appointment cannot reveal.

It can help a person retain continuity across a changing life.

But the same knowledge can control.

It can stigmatise.

It can become surveillance.

It can be sold.

It can be used to train systems without permission.

It can freeze childhood into adulthood.

It can let an old interpretation outrank a present refusal.

It can make the machine sound more certain than anyone has the right to be.

So the question is not merely:

What does Amanah remember?

It is:

What does Amanah have the right to claim it knows?

The answer should never be hidden inside the model.

It should be visible in the spine.

Source.

Context.

Status.

Authority.

Uncertainty.

Review.

Expiry.

Disagreement.

Person confirmation.

And the humility to say:

“This may matter. But it is not yet known.”

---

Research status

This essay extends the fourteen foundational Amanah Companions articles, particularly:

• A Parent’s, Guardian’s, or Carer’s Knowledge as Infrastructure
• Designing the Care Profile
• AAC Integration and the Communication Map
• Care Memory vs Surveillance Archive
• Data Projections for Continuity-Based Care AI
• The Amanah Companion Framework: Spine, Stem Cells, and Care Memory
• AI Prototype Architecture for an Amanah Companion System

It also develops the later Amanah distinction between person expression, caregiver observation, professional guidance, approved care rules, machine hypotheses, relational memory, temporary working context, and device state.

The knowledge-state vocabulary in this article is proposed architecture. It has not yet been validated through clinical practice, disability advisory review, legal analysis, or software implementation.

Sources

1. World Wide Web Consortium, PROV-O: The PROV Ontology, W3C Recommendation, 30 April 2013. PROV-O provides a general model for representing provenance through entities, activities, agents, and qualified relationships. https://www.w3.org/TR/prov-o/ ↩
2. HL7 International, FHIR R5 Provenance Resource. The resource represents provenance associated with records and activities, including who, what, and when, and builds upon W3C provenance concepts. https://hl7.org/fhir/provenance.html ↩
3. National Institute of Standards and Technology, Artificial Intelligence Risk Management Framework (AI RMF 1.0), 2023. https://doi.org/10.6028/NIST.AI.100-1 ↩