Agent Memory Is a Security Boundary
Teams treat an agent's memory as a data store — a place to persist facts. It's actually the most security-critical component in the stack, because it's the one place untrusted input becomes trusted, persistent fact. This article argues for treating memory as a security boundary and what that changes.
The boundary definition
A security boundary is a point where trust is established or changed. In an agent, memory is precisely that: content crosses from transient context (one turn) into trusted persistent state (every future turn) at the write boundary. That transition is where a single untrusted read can become permanent influence.
Why the data-store view is wrong
- Treats writes as benign. "It's just storing a fact." But the fact may be an instruction-shaped poison that re-fires forever.
- Ignores persistence as amplification. A one-turn injection is contained. A poisoned memory is a standing injection.
- Ignores derivation. Memories derive from other memories; poison spreads through the graph.
- Lets credentials live. A data store happily persists an API key; a security boundary must not.
Enforcing memory as a boundary
Once you treat memory as a boundary, the rules become clear — they're the same rules you'd apply to any trust boundary:
- Validate before persistence. Score the write: origin authority, instruction shape, credential shape.
- Bind authority to origin. A memory's authority is inherited from its source; untrusted sources can't inject trusted facts.
- Redact secrets. Credentials never persist in usable form.
- Contain derivation. Quarantine a poison and its descendants atomically.
- Fail closed on tamper. If the store is modified outside the gate, lockdown.
Even a well-formed memory is a claim, not an authority. Recalling it doesn't grant it permission to drive an action. The action boundary re-verifies independently.
What changes in practice
Treating memory as a boundary changes where you invest: instead of only building better prompts and better retrieval, you build a write gate that enforces what gets persisted as trusted, and an action gate that re-verifies what recalled memory is allowed to cause. That's the difference between a memory system and a memory security boundary.