Persistent Memory Schema

1. 01

   Concepts & system design

   60 min· read · map the mechanismtimer

   R41 — OWASP Agentic AI memory & state risks

   R17 — NIST Privacy Framework lifecycle

   R05 — MITRE ATLAS persistence/poisoning

   Read the assigned sections; map the mechanism, threat model and trade-offs.

2. 02

   Project implementation

   120 min· build · integrate · debugtimer

   Build explicit persistent memory records (owner, tenant, source, timestamp, trust_label, ttl_expiry). *Lab:* Prove User A cannot query or overwrite User B's memory records.

   Test memory poisoning, stale memory correction, expiry, and deletion; ensure untrusted memory cannot grant tool permissions. Define the shared security-event envelope for D11.

   Build, integrate, debug and improve the increment in the active project.

3. 03

   Security lab

   60 min· attack your own systemtimer

   No separate task text for this block on day 14 — the sourced work sits in the block above. Keep the time box.

   Test the abuse case, failure path, authorization bypass or resource limit.

4. 04

   Verification & evidence

   30 min· test · record evidencetimer

   Memory threat model, cross-user isolation tests, expiry/deletion tests, and versioned D11 event schema.

   Add or run regression tests; record the 9-point evidence record.

5. 05

   Deliberate practice & Socratic review

   30 min· explain aloud · update gapstimer

   Answer the 8 Socratic questions without notes: What? Why? How? What if? Why not? How can I prove it? Where can it break? What have I learned?

   Re-explain the hardest concept aloud, inspect one edge case, update the gap log.

6. total5 h

• R05MITRE ATLAS↗ atlas.mitre.org

  ML attack tactics/techniques: prompt injection, data poisoning, model extraction, and exfiltration.

• R17NIST Privacy Framework↗ nist.gov

  Identify-P, Govern-P, Control-P, Communicate-P, and Protect-P lifecycle controls.

• R41OWASP Agentic AI Resources↗ genai.owasp.org

  Agentic threat taxonomy: tool misuse, excessive agency, memory poisoning, inter-agent trust, and human oversight.

Read only the named sections needed for today's task. Reading sits inside the 60-minute concepts block; it is not extra time.

• docsNIST
  Privacy Framework | NIST

  The Identify-P, Govern-P, Control-P, Communicate-P, and Protect-P functions give the lifecycle controls that justify owner, tenant, source, retention, and deletion fields on a memory record.

  R17checked 2026-11-11
• videoProduct Security Podcast · 6:27
  Memory Poisoning in AI Security

  Explains how a single untrusted write persists in memory and influences later turns, which is why a trust_label and TTL must travel with each stored record.

  M6S3checked 2026-11-11
• videoHussein Nasser · 25:29
  Multi-tenancy architecture | The Backend Engineering Show

  Compares shared-schema with tenant_id plus row-level enforcement against schema-per-tenant, which is the isolation decision behind proving User A cannot read User B's memory rows.

  M6R17checked 2026-11-11
• articleOWASP Gen AI Security Project
  Agentic AI - Threats and Mitigations

  Catalogs memory poisoning, tool misuse, excessive agency, and inter-agent trust as distinct agentic threats, which is the taxonomy your security-event envelope for D11 has to cover.

  R41M6unchecked 2026-11-11
• repoGitHub
  mem0ai/mem0

  Memory layer whose records carry user_id, agent_id, and metadata with scoped add/search/delete calls, giving a concrete schema for owner, tenant, and expiry on each memory write.

  M6checked 2026-11-11

A lab is complete only when it produces evidence. Installing PyRIT, Garak, Presidio or TransformerLens is not completion. Saved on this device only.