Custody: your agent's memory knows who wrote it, not whether it can be trusted

Описание и применение

Custody добавляет граф происхождения к памяти агентов, позволяя при компрометации источника отзывать только затронутые записи, сохраняя остальную историю.

Задача

Agent memory systems track authorship but not trust, leading to memory poisoning when a compromised source propagates through multiple departments.

Результат

By tracking derivation, Custody reduced memory purging from 100% to 93% when a tool was compromised, preserving 40 of 600 records.

Рабочий процесс

• 1. Vendor tool feeds data to sales agent. 2. Sales writes memory from tool. 3. Support summarizes sales memory into new memory. 4. Finance summarizes support memory. 5. Vendor tool compromised. 6. Custody identifies compromised root and walks derivation graph. 7. Custody revokes only the three descendant memories. 8. Reviewer, Onboarding, Auditor, Escalation agents coordinate human review and incident notice.

Доказательства

Custody makes that chain a first‑class object. Every memory event gets labeled by structure, USER, MODEL, TOOL, or DERIVED, off ADK's event graph, before it's ever written, not inferred after the fact.

Источник

On our own 600‑record fixture, that's the difference between destroying 100% of fleet memory to contain one bad tool and destroying 40 records, 93% preserved.

Источник