Engineering · September 5, 2026
Three boundaries for safe agent memory
Keep account ownership, end-user scope and action authorization distinct.
Account ownership is the outer boundary
Authenticate every request and ensure each referenced collection belongs to the calling account. A guessed or foreign ID should not disclose another customer's records. API keys should carry the minimum scopes required, and revocation must invalidate future operations and replays rather than merely hide a key in the interface.
Keep end-user context explicit
An application account can contain many customers and agents. Carry the correct collection and end-user identifiers through ingestion, retrieval, graph access and feedback. Test two synthetic tenants in both directions. A dashboard owner's inventory view is an administrative view, not a reason to widen a normal application key's access.
Evidence cannot authorize an action
Stored text can contain mistakes or hostile instructions. Treat it as untrusted data even when it has a citation. Check the current policy, actual actor permissions and required approvals outside the memory system before sending, deleting, purchasing or executing. Preserve an audit trail of the evidence and authorization used.