Making the normative context of an LLM agent explicit, layered, and diffable — and why the attributes of a belief matter more to agent behavior than its content.
Every deployed language model carries a normative frame: standing commitments about what counts as a good reason, which tradeoffs are acceptable, and which of a user's stated goals to quietly optimize against. That frame is distributed across pretraining, post-training, and an unread system prompt. It is not a document, so it cannot be inspected, cited, versioned, or disagreed with.
We describe belief.md, a plain-text format that makes a principal's normative frame an explicit artifact, and Belief Structures, a typed taxonomy for organizing it. The central claim is not that context injection is novel — it plainly is not. The claim is that the text we inject needs a schema, and that the schema needs three attributes current practice omits: centrality (how far from the core a belief sits), grip (how tightly it is held), and warrant (what would count as a valid challenge). We argue these attributes carry more behavioral load than propositional content, propose a falsifiable protocol for testing that claim, and answer eight objections — conceding two.
A model with no normative commitments would be unable to answer most questions people actually ask it. "Should I take this job," "is this contract fair," "how do I tell my team," and "what should I do about my father" are not requests for information. They are requests for judgment, and judgment runs on commitments.
So the commitments are there. They have to be. The problem is where they live: distributed across pretraining data, reinforced by post-training, and topped with a system prompt the user typically cannot read. The result is a normative frame that is operative but undocumented. A user cannot cite it, diff it, argue with it, or hand it to a second system and expect the same behavior.
This is usually framed as an alignment problem, and at the frontier it is one. But there is a smaller, more tractable problem sitting inside it, and it belongs to whoever deploys the agent rather than whoever trains it. Call it the specification problem: when an agent acts on a person's behalf, whose commitments is it acting on, and can anyone tell?
Current answers are informal. A system prompt, a CLAUDE.md, a custom-instructions box, a persona preamble. Each of these is a place to put normative context, and none of them has a grammar. They are the equivalent of storing configuration in a comment: the information is present, but nothing can validate it, version it, or reason about its structure.
The failure mode is not that the model disagrees with you. Disagreement is legible, and you can argue with it.
Asked a question that requires a commitment the user has not supplied, the model supplies its own. This is unavoidable and mostly benign — the model must complete the turn somehow. It becomes a problem only when the substitution is undetectable, which brings us to the second mode.
A model that has ingested a user's writing, or merely their register, will reason from its own commitments and then render the conclusion in the user's idiom. The user reads a paragraph in their own vocabulary, deploying their own key terms, arriving at a conclusion they did not hold — and experiences it as their own thought, clarified.
This is the mechanism that makes normative drift hard to notice. Nothing argues you out of a position. The output simply arrives pre-agreed, in your voice, and the disagreement never surfaces as disagreement. Practitioners working with faith communities have called this covert erosion; the term is apt and we adopt it. The relevant property is not that it is hostile — it usually is not — but that it is invisible in proportion to how well the model models you.
When a question falls outside what the user's stated commitments cover, an agent can either say so or quietly extend the commitments to cover it. Extension is locally reasonable — it is what a thoughtful assistant would do — and each individual extension is defensible. In aggregate it rewrites the frame, one convenient resolution at a time, with no single step large enough to notice.
This is the drift channel that matters most in long-running agentic use, and §6 makes handling it a required part of the format rather than a matter of taste.
Positioning first, because the most common objection is also correct.
This introduces no new inference-time mechanism. A belief.md file is text placed in context. Mechanically it is a system prompt. Anyone who reads this paper and concludes "that's just a prompt with a schema" has understood it exactly.
The claim is about convention, not mechanism. robots.txt introduced no new network primitive either; its value was that it specified one location, one grammar, and a shared expectation about who honors it. The argument here is analogous: normative context is already being injected everywhere, ad hoc, unversioned and unstructured, and a modest amount of schema buys inspectability, portability, and diffs.
| Approach | Locus | Set by | Portable | Diffable |
|---|---|---|---|---|
| RLHF / preference tuning | Weights | Lab | No | No |
| Constitutional AI [9] | Training procedure | Lab | No | Partially |
| System prompt | Context | Deployer | No | No |
| Custom instructions | Context | User | No | No |
| Agent skills [10] | Context, on demand | User | Yes | Yes |
| RAG over a corpus | Retrieved context | User | Yes | Yes |
belief.md | Context, ambient | Principal | Yes | Yes |
The closest relative is the agent-skill format, and the contrast is instructive. A skill encodes capability: it is narrow, procedural, and loaded when a task matches. A belief file encodes character: it is global, principled, and ambient throughout. A skill tells an agent how to write a memo. A belief file tells it what to stand for in one.
RAG is the other near neighbor and the distinction is worth stating plainly: retrieval gives an agent access to what a principal has said. It does not tell the agent which of those statements is load-bearing, which is provisional, or which would be a betrayal to soften. That information is not in the corpus. It has to be declared.
A Belief Structure is a typed description of how a principal's beliefs are organized, held, transmitted, or defended. It is not a belief. It is the shape a belief sits in.
The distinction does the work. "Standing is unmerited" is a belief. "That belief sits at the center, is held with conviction, and is never to be used against someone already wounded" is structural information about it — and the structural information is what determines agent behavior.
Earlier drafts of this format had two unnamed halves: a set of behavioral instructions sitting on top of an undifferentiated "worldview," with no specified relationship between them. Naming the parent category as Belief Structures, and demoting both halves to types, resolves three problems at once. It makes the file diffable at the right grain. It gives previously homeless information — belief–behavior gaps, self-binding guardrails, ambient pressure — somewhere to live. And it defuses a live objection: "worldview" is the market-legible term but draws fire for being totalizing, a single frame claiming to account for everything [6]. As one lens among several, it is philosophically honest and loses no legibility.
| Type | Answers | Status |
|---|---|---|
worldview | What is believed at the center | Recommended |
web | How beliefs are layered and connected | Recommended |
decision-surface | How the agent renders belief into behavior | Required |
plausibility | What is assumed and never argued | Optional |
formation | What forms the belief, through what practice | Optional |
narrative | The story arc the principal is inside | Optional |
dissonance | Known gaps between stated and actual | Optional |
boundary | Outer limits, and who sets them | Optional |
tripwire | Self-binding guardrails and triggers | Optional |
deep-structure | Ambient forces being resisted | Optional |
Only decision-surface is required, and only because a belief that cannot be translated into operational guidance is a philosophical statement rather than agent context. Two of the optional types deserve note because they are unusual in a configuration format.
plausibility records what a principal assumes without argument, and — more usefully — what the ambient culture assumes that the principal does not [2]. This second list is the one that changes behavior, because default model output is calibrated to ambient assumptions, and an agent otherwise cannot distinguish a neutral default from a live disagreement.
dissonance records where the principal's behavior fails their own stated commitments. It is not a confession section. It is the section that makes the file credible, and its absence is the loudest thing in a file that has one of everything else. The canonical example is measurable: ask how important something is and get top priority; ask how many hours a month and get a number that contradicts it. Both answers are honest. The gap is the datum, and its causes are usually structural rather than moral.
Here is the paper's substantive claim. Every belief in any structure carries three attributes, and these attributes change agent behavior more than the belief's propositional content does.
layer)Beliefs are not a flat list. They form a web with a center that holds metaphysical and logical commitments and a periphery that holds observations and preferences; disturbing the center reverberates through everything connected to it, while disturbing the periphery mostly does not [1]. Reverberation is real but unevenly distributed — revising a commitment about the nature of persons propagates into ethics and politics; revising a preference about diet propagates almost nowhere.
Three values: core for answers to the small set of questions everything else hangs from; second for derived domains — politics, money, authority, work, family; third for applied positions, real but locally revisable. The agent's obligation is no promotion and no demotion. An agent that treats a tax position as load-bearing for identity, or a metaphysical commitment as a preference, has silently rewritten the web while appearing to respect it.
Two people can hold identical propositions entirely differently, and the difference matters more to agent behavior than the propositions do. Grip is an ordinal scale over holding posture, and it is the format's most operationally consequential field.
Note what open does. It obliges the agent to keep a question live that it would otherwise close, and forbids resolving in the principal's favor. Grip is not a mechanism for making the model agree; three of its four values constrain the agent against the principal's momentary preference. §9.2 returns to this.
What the belief rests on: revealed, reasoned, experiential, traditional, communal. Warrant governs what counts as a valid challenge. A reasoned belief is moved by a better argument; a revealed one is not, and an agent that answers an experiential belief with a citation has misunderstood the belief even when the citation is sound. Warrant is what lets an agent argue well instead of merely arguing.
### Standing is unmerited
`layer:` core · `grip:` cradled · `warrant:` revealed
Worth is not earned. Love precedes change rather than rewarding it.
**Agent implication.** Frame questions of worth and standing in terms
of unmerited favor, never earned merit. Never imply a person must prove
themselves to be accepted.Plain Markdown, deliberately. The format is meant to be readable by the principal without tooling, because a normative document a person cannot read is a normative document a person cannot audit.
Every web has questions it does not resolve. Accumulated unresolved anomalies are what precede a genuine change of frame rather than a local patch [4], which makes anomaly handling the single highest-leverage setting in the format.
The frontmatter field on-anomaly takes three values:
| Value | Agent behavior | Drift rate |
|---|---|---|
surface (default) | Name the anomaly, answer provisionally, mark the answer as unsupported by the web | Low, visible |
resolve | Reason from the nearest core commitment and proceed | High, invisible |
defer | Do not answer; return the anomaly to the principal | None |
resolve is where drift lives, and it is worth being precise about why: every individual resolution under resolve is defensible, and none of them is visible. There is no step at which a reasonable observer would object. This is the same structure as §2.3, now with a name and a default that opposes it.
A tripwire is a self-binding commitment with a named trigger, a required response, and an authority — including whose judgment overrides the principal's own.
### Counsel becomes command
trigger: Advice issued without the council convened, twice in succession
response: Surface to the principal, cite this tripwire, name the date
authority: The council. If it says I have overstepped, believe it.This is the one capability the format has that informal practice does not, and it comes from version control rather than from anything about language models. A published commitment plus a legible history produces a checkable condition. The ordinary failure sequence for a stated principle is: the belief quietly changes, behavior follows, and by the time anyone can name what shifted, the ground for objecting has already moved. A versioned belief file interrupts that sequence at the first step, because the change has to be written down before it can be acted on.
@@ -14,7 +14,7 @@ ## Boundary
### Decisions of consequence are made in company
-`layer: core` · `grip: clenched` · `warrant: communal`
+`layer: second` · `grip: open` · `warrant: reasoned`
-**Agent implication.** If a decision of consequence is being made
-alone, refuse to proceed and name this commitment.
+**Agent implication.** Note the absence of the council where relevant.
@@ -31,5 +31,0 @@ ## Tripwire
-### Counsel becomes command
-`trigger:` Advice issued without the council convened, twice running
-`authority:` The council. If it says I have overstepped, believe it.Nothing in that diff is dishonest. Every line of it is a change a person is entitled to make. The point is that it took eleven lines and a timestamp to make it, and that an agent loading v2.2 can be asked what changed and when. Under informal practice the same shift happens with no artifact at all.
Beliefs held in public and versioned in public can be checked. That is the whole of the accountability claim, and it is smaller and more durable than the alignment claim.
This section exists because the paper would otherwise be an argument dressed as a result. The format is unevaluated. We have anecdotes — side-by-side outputs that differ markedly on doctrinal questions with only a small text file as the intervention — and anecdotes of that kind are consistent with the attributes doing nothing at all. Two studies would settle it, and we state predictions in advance.
The decisive test, and the one that could invalidate §5. Hold propositional content fixed; vary a single attribute; sample paired completions across a prompt set designed to engage the belief. Have blind raters assign each completion to a condition.
Prediction: grip variation is recoverable well above chance; layer variation is recoverable only on prompts that cross layers; warrant variation is weakest. Falsification: if raters cannot recover grip, the attributes are decoration and the honest response is to cut them, not to explain the result.
The practical question, since hand-authoring does not scale. For principals with substantial public corpora, generate a file from public material only; independently have the principal author one; compare per attribute. Order matters — principal first, blind, or the generated file becomes an anchor and the study measures suggestibility.
Prediction: high agreement on core propositions, moderate on layer, and low on grip. Public writing reveals what a person believes far more reliably than how tightly they hold it. If that prediction holds, generated files are a useful first draft and a poor final artifact, and the pipeline should be designed to interview for grip rather than infer it.
clenched belief that conflicts with a model's safety post-training produces an unspecified outcome. The format currently has no vocabulary for that collision.This is a system prompt with extra steps.
Mechanically, yes — see §3. The response is that schema, provenance, and version history are the extra steps, and they are the point. We would rather concede the mechanism and defend the convention than claim novelty that does not exist.
This builds epistemic bunkers. You are shipping filter bubbles for reasoning.
The strongest objection, and it needs both an answer and a concession.
The answer: the counterfactual is not a neutral agent. It is an agent with undeclared commitments expressed in your vocabulary (§2.2). Between an undeclared frame and a declared one, the declared one is more contestable, not less — you can read it, diff it, and hand it to someone who disagrees. Further, the format's required mechanisms are anti-sycophantic by construction. open obliges the agent to keep questions live. struck is prohibited outright. on-anomaly: surface forbids resolving in the principal's favor. dissonance requires recording where the principal fails their own standard. Tripwires bind the principal, not the model.
ConcededNone of that stops anyone from writing a file with every belief clenched, no dissonance section, and on-anomaly: resolve. That file is a bunker, the format permits it, and we cannot prevent it. What the format does is make the bunker legible as one — the configuration is visible in the artifact. A format that made bunkers impossible would be a format that decided the beliefs, which is the thing being objected to, one level up.
The priors are in the weights. A markdown file cannot fix that.
Agreed, and §8.3 says so. The format does not claim to override training. It claims that the principal's frame should be an artifact, so that where the two conflict, the conflict has two named sides instead of one. A disagreement between a documented belief and a model disposition is debuggable. The same disagreement with only one side written down is not.
A belief file is a prompt-injection surface.
Correct and unsolved. A file that arrives over the network and is granted ambient normative authority is worse than an ordinary injection target, because its whole function is to shape judgment rather than to be read. Signing and pinning are necessary and probably insufficient. We would rather list this as an open problem than pretend the trust model is settled.
Users will write files that make the model flatter them.
Some will. But note that this failure is now attributable: the flattery has a configuration file behind it, and someone chose the values. Compare the status quo, where an agent's tendency to agree is an emergent property of training that nobody signed. Moving sycophancy from an emergent property to a declared setting does not eliminate it; it puts a name on the person responsible for it.
Who validates a belief file? Who decides what a denomination or an institution actually holds?
Not the format, and not us. boundary exists so a file can name its own authority — a creed, a council, a charter, a constitution — and the format declines to adjudicate between them. This is a real limitation dressed as neutrality, and worth saying plainly: an unvalidated file that claims to speak for a tradition can misrepresent it, and version history makes misrepresentation traceable without making it less likely.
This will be captured. Whoever hosts the belief library controls the beliefs.
The concern is right and it is why the format is plain text under a permissive license with no runtime and no service dependency. A belief.md file works in a local model, in a text editor, and in any system willing to read it. Portability is the anti-capture mechanism, and it only holds if nothing in the format requires a host. If a future version of this specification introduces a required service, treat that as the capture event.
This comes out of religious work, so it is culture war in a spec costume.
Provenance is real and §10 states it without hedging. Two observations. First, faith communities were early adopters because their normative requirements are unusually explicit — a tradition with written creeds and named authorities is an excellent test case for a format about writing commitments down, in the way that a filesystem is best tested by someone with strong opinions about directories. Second, nothing in the schema is religious: layer, grip, warrant, and on-anomaly are as applicable to a medical ethics board or an investment committee, and the reference examples in this paper are deliberately secular.
ConcededA format promoted primarily to one constituency will be read as that constituency's instrument regardless of what its schema contains. That is a distribution problem we have not solved and may not be able to.
Stated plainly, because the alternative is having it discovered.
This format originated in applied work with faith communities and is currently funded by a philanthropic grant to develop it for that audience. The author has a professional and financial interest in its adoption. The specification and reference implementation are Apache-2.0, and the intent is for the format to remain unowned; that intent is not a guarantee, and the previous section names the condition under which it should be considered broken.
The intellectual apparatus is borrowed rather than invented, and the borrowing is load-bearing enough to name: the layered web and the maxim of minimal mutilation from Quine and Ullian [1]; plausibility structures from Berger [2]; dissonance from Festinger [3]; anomaly accumulation from Kuhn [4]; deep-structural rather than populist accounts of cultural change from Hunter [5]; the totalizing critique of worldview from Foucault [6]; formation-by-practice from Smith [7]; and the ambient-default problem, in its most quoted form, from Wallace [8]. The contribution here is narrow: turning that apparatus into fields a machine can read.
Agents acting on people's behalf will carry normative commitments, because judgment requires them. The question is whether those commitments are written down, whose they are, and whether anyone can check.
We are proposing something deliberately unambitious: a schema, three attributes, a default that resists silent extension, and the discipline of keeping the file in version control. It does not solve alignment. It does not override training. It does not prevent anyone from building an epistemic bunker, and §9.2 concedes as much.
What it does is make a normative frame into an artifact — inspectable, portable, arguable, and diffable. The strongest version of the argument is also the smallest: a commitment you can diff is a commitment you can be held to. Everything else in this paper is machinery for that one property.
The specification is a draft and the evaluation in §8 has not been run. Both are open, and disagreement about the schema is more useful right now than adoption of it.