Custody: your agent's memory knows who wrote it, not whether it can be trusted

说明与用途

Custody 为代理记忆添加派生图，允许在源被破坏时仅撤销受影响的记录，保留其余历史。

问题

Agent memory systems track authorship but not trust, leading to memory poisoning when a compromised source propagates through multiple departments.

结果

By tracking derivation, Custody reduced memory purging from 100% to 93% when a tool was compromised, preserving 40 of 600 records.

工作流

• 1. Vendor tool feeds data to sales agent. 2. Sales writes memory from tool. 3. Support summarizes sales memory into new memory. 4. Finance summarizes support memory. 5. Vendor tool compromised. 6. Custody identifies compromised root and walks derivation graph. 7. Custody revokes only the three descendant memories. 8. Reviewer, Onboarding, Auditor, Escalation agents coordinate human review and incident notice.

证据

Custody makes that chain a first‑class object. Every memory event gets labeled by structure, USER, MODEL, TOOL, or DERIVED, off ADK's event graph, before it's ever written, not inferred after the fact.

来源

On our own 600‑record fixture, that's the difference between destroying 100% of fleet memory to contain one bad tool and destroying 40 records, 93% preserved.

来源