Requirements
- The store filters every recall item by item against who is asking, so a recall returns nothing that the person was never allowed to see.
- Everything that reads the store passes that filter, including the code that runs the agent.
- The record of what the agent said and did accepts new entries, and no entry can be altered.
- A later edit, removal, reordering, or missing end is detectable.
- That record can be verified afterwards without trusting the store or anything still running.
- Deleting a conversation's data leaves that record intact, including when someone wants the conversation gone.
- What the agent learned and the record of what it did live in the same store, so one question can cover both.
- Memory and knowledge start out shared within one session only. Any wider sharing is a capability that a person grants, not the default.
Security considerations
Assume the attacker reaches the store through the agent's own code. That code is an internal caller, not a request arriving at the door, so a check placed only on the way in is never reached. The check lives with the records instead. What proves that a caller may read is issued elsewhere, so the caller cannot manufacture it. The record of what happened is signed, so a later change is detectable even to someone with direct database access.
Residual risk: Detection is not prevention, and an attacker with that access can still destroy the store.
Non-qualifying systems
Commonly substituted components: a search index with a column for whose data each row is, plus an audit log kept beside it. Any of the following disqualifies a system:
- A filter the caller supplies decides who may see a result.
- Code inside the system reads the store without passing the check that outside callers pass.
- Anyone with access to the database can rewrite the record of what happened. Nothing in the record would show the change.
- Deleting a conversation deletes its record of what happened along with it.
- What the agent learned and the record of what it did sit in different systems. No single question can cover both.
- Every agent starts with access to global memory, shared across all sessions.