Quipu: A Governed Bitemporal Knowledge Graph Store | AI Research

Quipu is an embeddable knowledge graph store designed to manage data written by software agents. Researcher Steve Brown argues that current knowledge graph stores rely on outdated defaults—such as accepting data without validation and treating all writers as equally trustworthy—that are unsuitable for automated agents. Quipu replaces these with a "start strict" approach, where the store enforces governance, trust, and historical accuracy at the point of data entry.

Rethinking Store Defaults

The paper identifies four conventional defaults that create liabilities when agents, rather than humans, write to a database:

• Accept, then clean: Conventional stores accept data immediately and rely on later review. Quipu instead uses a gate that evaluates the "post-state" of the data, refusing invalid writes before they enter the system.

• One time axis (or none): Traditional systems often fail to track the history of trust or policy decisions. Quipu is fully bitemporal, meaning data, trust labels, governance rules, and audit verdicts are all indexed by both transaction time and valid time.

• Flat trust: Many stores treat all named graphs as equally authoritative. Quipu uses a lattice-based composition model where trust and authority are partitioned, ensuring that combining data never widens the scope of trust.

• Governance outside: Policies are often managed by external middleware. Quipu treats the governance specification, the audit trace, and signed verdicts as facts within the store itself, allowing the system to audit itself via a query.

How Quipu Works

Quipu functions as a bitemporal EAVT (Entity-Attribute-Value-Transaction) log. It implements a three-valued operation system—assert, retract, and tombstone—to manage data lifecycle and layered composition.
Governance is handled by a "gate" on the write path. When an agent attempts to write data, the store checks the pending state against a set of policies. If the write is denied, the store rolls back the data but persists a signed, time-indexed verdict of the refusal. This ensures that the store maintains a permanent, auditable record of why specific data was rejected. Because these policies and verdicts are stored as data, the system can perform a deterministic audit to verify that the trace of actions satisfies the governance specification.

Performance and Evaluation

The system was evaluated using "Census," a deterministic multi-writer lifecycle benchmark. In these tests, the gated Quipu store successfully blocked all six planted defects, whereas an ungoverned version of the store accepted all of them.
Regarding performance, the paper notes that while the gated store incurs higher latency than an ungoverned one—due to the overhead of policy evaluation, verdict signing, and authority intersection—the system remains functional for agent workloads. On the DEMM-Bench governance benchmark, Quipu correctly answered all 512 property-level governance questions with zero overclaim, outperforming container-presence baselines that overclaimed on up to 87.5% of cases.

Considerations for Implementation

Quipu is implemented as a Rust crate that uses a single SQLite file as its storage substrate. The system is designed to be embeddable and supports various interfaces, including CLI and REST.
Franklin analysis: The paper emphasizes that the store’s guarantees are interlocking. For example, the gate is effective because verdicts are permanent, and the audit is decidable because the governance rules are stored as data. A potential limitation noted in the paper is that the store’s basic graph pattern join cost grows quadratically with store size, though the author notes that caching and in-memory read models can mitigate this. The author explicitly states that the paper focuses on architectural defaults and guarantees rather than comparative query-performance throughput.