Skip to content
Roadmap0/111
domain M65h

AI Memory Security

Store persistent memories and LangGraph checkpoints as explicit records bound to `owner`, `tenant`, `source_provenance`, `trust_label`, and `ttl_expiry`. Enforce write authorization, prevent untrusted memories from elevating privileges, and propagate deletions across caches and vector indexes (`D10`).

Module detail

Best time to learn: At the exact point persistent memory is added to Project 1; revisit the same controls when Project 3 introduces checkpoints or long-lived agent state.

Prerequisites - Database ownership and tenant isolation. - RAG authorization and provenance. - Conversation persistence. - Basic privacy and retention concepts.

### Threat model

Memory is durable state that can influence future model behavior. A malicious or unauthorized write can persist beyond the original conversation; an access-control error can expose one user's history to another.

Study: - Memory write versus read authorization. - User, session, tenant, and agent identity boundaries. - Memory provenance and trust labels. - Memory poisoning and stale facts. - Sensitive memory classification and minimization. - Expiration, deletion, correction, and retention. - Memory retrieval authorization and audit events. - Checkpoint integrity and replay risks.

### Labs

  • Isolation test (1h): Prove users cannot read, search, overwrite, or delete another user's memories.
  • Poisoning test (1h): Add an adversarial memory entry in a controlled test and verify provenance, confirmation, or trust rules prevent it from silently becoming privileged instruction.
  • Lifecycle controls (2h): Implement TTL, deletion, correction, and retention behavior. Verify derived indexes and caches follow the same deletion policy.
  • Replay and integrity (1h): Test stale checkpoint replay and unauthorized state restoration.

### Project integration

  • Project 1: Every memory record has an owner, source, timestamp, trust classification, and retention rule.
  • Project 3: Checkpoints are bound to the correct user, tenant, workflow, and authorization context.
  • RAG: Memory search applies authorization filters before content is returned to the model.

### Measurable completion criteria

  • Cross-user memory access tests pass.
  • Memory writes have provenance and authorization checks.
  • Deletion covers primary records and relevant derived indexes/caches.
  • Untrusted memory cannot grant tool permissions or override application policy.
  • You can explain what is remembered, why, for how long, and how it is removed.

------------------------------------------------------------------------

Study days for this domain

6

Readings

← all domainslibrary →