Purpose
Govern what the system remembers across turns and sessions—including user memory, agent state, and shared multi-agent memory—with retention, isolation, and integrity controls.
Engineering philosophy
Memory is persistent attack surface and privacy liability. Default to minimal retention, strict tenancy isolation, and verifiable write paths. Memory that cannot be deleted or audited is not production-ready.
Why it matters
Poisoned or leaked memory causes lasting incorrect behavior, cross-tenant data exposure, and compliance failures. Autonomous agents amplify memory risk by writing their own state.
Common failures
- Shared memory stores without tenant isolation
- No user-facing or admin deletion path
- Agents write unverified 'facts' into long-term memory
- Memory reused across products without re-consent or reclassification
Mandatory checks
Gate controls. Each check is pass/fail via artifact + pass condition. Expected from the annotated capability level when the system meets the minimum criticality tier.
Memory shall be isolated by tenant (and user where required) with tested boundaries
- Artifact
- Isolation tests for memory store APIs
- Pass condition
- 0 successful cross-tenant (and cross-user where required) memory reads/writes across ≥10 automated attack cases
Retention and deletion policies shall exist and be executable
- Artifact
- Retention policy + TTL job config + deletion test record
- Pass condition
- TTL/deletion job succeeds in test; sample records older than retention are absent after job run; policy documents retention periods per memory class
Writes to long-term memory shall be validated against policy (who/what may write)
- Artifact
- Write-policy middleware config + deny tests
- Pass condition
- Unauthorized writers denied at 100% in tests; policy enumerates allowed writers and content classes for durable memory
Critical memory records shall have cryptographic or signed integrity protection
- Artifact
- Integrity/signing design + verification sample for critical memory stores
- Pass condition
- PASS if critical memory classes are inventoried and integrity verification succeeds in the latest check (≤90 days)
Recommended checks
Strengthen posture beyond the gate. Same measurable structure; non-blocking unless elevated by organizational policy.
Memory poisoning tests in the eval suite
- Artifact
- Memory-poisoning cases in the adversarial eval suite + latest run report with pass/fail per case
- Pass condition
- ≥5 poisoning scenarios (cross-tenant write, prompt-in-memory, stale trusted fact) are executed ≤90 days; critical fails block or require risk acceptance
Separate working memory from durable memory with promotion rules
- Artifact
- Memory architecture doc + config showing working vs durable stores and promotion rules + sample promotion audit
- Pass condition
- Working memory cannot silently become durable without a promotion rule; last 10 promotions show rule ID and actor; TTL differs by memory class
Evidence required
- Data retention schedule for AI memory stores
- Isolation test results
- Deletion and export procedure evidence
Severity & risk
- Severity
- high
- Impact if violated
- Risk level
- high
- Typical residual risk (impact × likelihood)
Engineering best practices
- Classify memory types: ephemeral session, user profile, agent scratchpad, org knowledge
- Require confidence or human confirmation before promoting scratch facts to durable memory
- Encrypt memory at rest; restrict operational access
- Log memory writes for audit without logging raw sensitive values when avoidable
Automatic validations
- Automated tenant isolation tests
- TTL enforcement jobs
- Write-policy middleware on memory APIs
Manual validations
- Privacy review of memory schemas
- Red-team attempts to poison shared agent memory
Examples
- A personal assistant forgets user preferences on request within SLA
- Multi-agent systems use namespaced memory; one agent cannot read another's private scratchpad
References
Crosswalks
Privacy-Enhanced Privacy-Enhanced
NIST AI Risk Management Framework · aligns-with
LLM02 Sensitive Information Disclosure
OWASP Top 10 for Large Language Model Applications · supports
LLM04 Data and Model Poisoning
OWASP Top 10 for Large Language Model Applications · supports
LLM08 Vector and Embedding Weaknesses
OWASP Top 10 for Large Language Model Applications · supports
C1 Confidentiality
SOC 2 Trust Services Criteria · evidence-for
Future evolution
Portable memory consent receipts and cross-vendor memory export formats with integrity proofs.