Audience-Bound Persistent Memory: Authorization Across the Memory Lifecycle
cs.CR, cs.AI
Submitted: 2026-09-28
Updated: 2026-09-28
Comments: 23 pages, 6 figures, 15 tables. Includes technical appendices and an ancillary research artifact
License: http://creativecommons.org/licenses/by/4.0/
The gist: A personal language agent that acts for its owner across private and shared conversations can learn a fact from one audience and later place it in the context it assembles for another.
Terminology
Abstract
A personal language agent that acts for its owner across private and shared conversations can learn a fact from one audience and later place it in the context it assembles for another. We study authorization before context across the whole memory lifecycle. Each memory item carries the audience present when it was recorded; derived items are partitioned by audience, receive the intersection of their sources' audiences, or are suppressed; an audience widens only by an explicit, object-specific grant; and an item enters a model attempt only when every current viewer belongs to one of its authorized audiences, with unresolved viewers failing closed to public-only. Under explicit identity, provenance and complete-mediation assumptions, this admission is sound and policy-complete on the exact assembled context, enforced by exclusion rather than by model behavior. We realize it in two independently persisted reference architectures, a flat store and a relationship graph, and, descriptively, in a native agent-memory runtime. In a prospectively frozen confirmation over 10,000 multi-party histories, no forbidden item entered any architecture's context, whereas unscoped retrieval exposed forbidden items in 82% of its contexts. Entitled recall matched policy-equivalent baselines exactly and exceeded unscoped retrieval by 0.30 Recall@5, with a Holm-confirmed advantage that grows with distractors. No architecture produced a wrong-principal substitution, but unscoped substitutions were too rare to establish the prespecified joint decision.
Sources
- Judging LLM-as-a-Judge: Concerning Rubric Artifacts in LLM-based Automated Text Generation Evaluation
- SuperLocalMemory 4.0: The Governed Memory Operating System for AI Agents
- Agent Memory Is a Surface for Endogenous Authorization Laundering
- A Judge Should Know What Changed:Construct Validity for LLM-as-a-Judge Evaluation
- Deployment-Time Memorization in Foundation-Model Agents
- MemSecBench: Tracking Agent Memory Poisoning from Persistence to Consequence and Repair
- Securing AI Agents with Information-Flow Control
- Defeating Prompt Injections by Design
- PiSAs: Benchmarking Contextual Integrity in Multi-User Agentic Systems
- Evaluating Long-Horizon Memory for Multi-Party Collaborative Dialogues
- Securing LLM-Agent Long-Term Memory Against Poisoning: Non-Malleable, Origin-Bound Authority with Machine-Checked Guarantees
- Governed Shared Memory for Multi-Agent LLM Systems
- Formal Policy Enforcement for Agentic Systems
- Can LLM-as-a-Judge Reliably Verify Rubrics in Agentic Scenarios?
- GateMem: Benchmarking Memory Governance in Multi-Principal Shared-Memory Agents
- Collaborative Memory: Multi-User Memory Sharing in LLM Agents with Dynamic Access Control
- MutMem: Cryptographically Authorized Mutation in Persistent Agent Memory
- MAP-Graph: Provenance-Aware Shared Memory for Multi-Agent Workflows
- GroupMemBench: Benchmarking LLM Agent Memory in Multi-Party Conversations
Related papers
- SoK: AI-Augmented Binary Reversing
- Relaxed Sender Anonymity for CBDC Interbank Settlement: A Zero-Knowledge Approach on Permissioned EVM
- Calibration-Family Overfit: Why Trusted Sabotage Monitors Don't Transfer Across Lineages
- Efficient Fuzzy PSI under One-Sided Assumptions
- Sealing the Audit-Runtime Gap for LLM Skills
- Token Composition: A Graph Based on EVM Logs