Custody: your agent's memory knows who wrote it, not whether it can be trusted

Description and use

Custody adds a derivation graph to agent memory, enabling selective revocation of only affected records when a source is compromised, preserving the rest of the history.

Problem

Agent memory systems track authorship but not trust, leading to memory poisoning when a compromised source propagates through multiple departments.

Outcome

By tracking derivation, Custody reduced memory purging from 100% to 93% when a tool was compromised, preserving 40 of 600 records.

Workflow

• 1. Vendor tool feeds data to sales agent. 2. Sales writes memory from tool. 3. Support summarizes sales memory into new memory. 4. Finance summarizes support memory. 5. Vendor tool compromised. 6. Custody identifies compromised root and walks derivation graph. 7. Custody revokes only the three descendant memories. 8. Reviewer, Onboarding, Auditor, Escalation agents coordinate human review and incident notice.

Evidence

Custody makes that chain a first‑class object. Every memory event gets labeled by structure, USER, MODEL, TOOL, or DERIVED, off ADK's event graph, before it's ever written, not inferred after the fact.

Source

On our own 600‑record fixture, that's the difference between destroying 100% of fleet memory to contain one bad tool and destroying 40 records, 93% preserved.

Source