---
url: 'https://adk.nht.io/the-loop/primitives/retrievable.md'
description: >-
  Content pulled in fresh for this turn — RAG chunks, web results, KB snippets —
  with a required trustTier.
---

# Retrievable

[Primitives](../primitives) covers the eight-primitive overview.

Where a [`Memory`](./memory) is something the agent recalls from a previous conversation, a [`Retrievable`](https://adk.nht.io/api/@nhtio/adk/common/classes/Retrievable) is something the agent pulled in from somewhere else *for this turn*. A chunk of a policy document. A snippet from a knowledge base. A web result. A passage out of a customer's uploaded PDF. It is the primitive that retrieval-augmented generation actually retrieves — the typed container the rest of the ADK needs in order to reason about what just got pulled in, where it came from, and how much weight it should carry.

The required field is [`Retrievable.trustTier`](https://adk.nht.io/api/@nhtio/adk/common/classes/Retrievable#property-trusttier), and it is the single most opinionated thing in the entire primitives set. The threat model for retrieved content depends *entirely* on where it came from: a signed internal policy document is in a different universe from a scraped web page, which is in a different universe from a stranger's uploaded resume. The executor that ultimately renders the record cannot guess which is which, the model has no way to tell the difference once they are all text on the screen, and the consequences of getting this wrong are how prompt injection through retrieval ends up working. Your retrieval middleware is the only party that knows the provenance, so your retrieval middleware is the only party trusted to declare it. The three values — `'first-party'`, `'third-party-public'`, `'third-party-private'` — name the only distinctions that load-bear at render time; see [RAG tiering](../trust-tiers/persistence) for how an executor should treat each one.

The optional fields exist so you, future-you, and the model can all judge the record after the fact: `source` (the URL, path, or KB id), `kind` (`'policy'`, `'web-page'`, `'pdf'`, whatever your retrieval pipeline emits), and `score` (relevance or similarity in `[0, 1]` if your retriever produced one). The ADK does not require them; an executor that wants to surface provenance to the model uses them.

::: danger No `'unknown'`. No auto-classification. No safe default.
Declaring the tier is the entry fee for handing content to the executor at all. If your middleware does not know the provenance of what it returns, that is the bug worth fixing.
:::