Paper deep dive
Authorization Before Context: A Model-Neutral Audience Boundary Against Cross-Audience Memory Leakage in Agentic Systems
Sibo Liu
Intelligence
Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 91%
Last extracted: 8/19/2026, 4:18:29 AM
Summary
The paper introduces 'Authorization Before Context,' a model-neutral audience boundary for personal language agents to prevent cross-audience memory leakage. It enforces an anti-monotone rule where a memory item is admitted to a prompt context only if all current viewers were present in the audience when the item was recorded. This ensures one-way confinement, anti-monotonic recall, fail-closed soundness on ambiguity, and poisoning containment, verified via synthetic evaluation.
Entities (8)
Relation Signals (6)
Authorization Before Context → mitigates → Cross-Audience Memory Leakage
confidence 97% · We introduce authorization before context: a single, anti-monotone audience-membership rule applied at the memory-to-context transition... ensuring... that nothing recorded for a narrower audience reaches a broader one
Authorization Before Context → implements → Audience Membership Rule
confidence 95% · We introduce authorization before context: a single, anti-monotone audience-membership rule applied at the memory-to-context transition.
Personal Language Agent → isvulnerableto → Cross-Audience Memory Leakage
confidence 94% · A personal language agent learns a fact from one audience and may later place it in the prompt it assembles for another. This memory-to-context step is an attack surface
Audience Membership Rule → enforces → Fail-Closed
confidence 92% · when that evidence is missing or inconsistent, it is treated as unknown and authorization fails closed to public-only.
Authorization Before Context → prevents → Poisoned Memory
confidence 90% · ensuring... that poisoned memory cannot widen its own audience.
Authorization Before Context → isbasedon → Contextual Integrity
confidence 88% · grounded in Contextual Integrity (Nissenbaum, 2004), moved from object access to prompt-context assembly.
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:A personal language agent learns a fact from one audience and may later place it in the prompt it assembles for another. This memory-to-context step is an attack surface: ambiguous or inconsistent channels, cross-audience prying, and poisoned memory can each cause the system to assemble context containing a fact relevant to the query yet unauthorized for the current viewers. We introduce authorization before context: a single, anti-monotone audience-membership rule applied at the memory-to-context transition. Each item carries the audience present when it was recorded; the current viewer set is read from channel metadata and falls back to public when ambiguous; and the item is admitted only when every current viewer already belonged to its audience. We prove that this rule gives every participant cross-channel recall while ensuring, by exclusion rather than by model behavior, that nothing recorded for a narrower audience reaches a broader one and that poisoned memory cannot widen its own audience. The boundary is a model-neutral invariant on the exact assembled context: a forbidden fact must be absent before the model is called. On a synthetic Contextual-Integrity suite, no forbidden fact entered the context our boundary assembled, whereas unscoped baselines included such facts by construction; we further audit that every read path fails closed. The evidence is preliminary and synthetic.
Tags
Links
- Source: https://arxiv.org/abs/2608.17148v1
- Canonical: https://arxiv.org/abs/2608.17148v1
Trouble viewing inline? Open PDF directly →
Full Text
37,696 characters extracted from source content.
Expand or collapse full text
Author preprint. Authorization Before Context: A Model-Neutral Audience Boundary Against Cross-Audience Memory Leakage in Agentic Systems Sibo Liu Independent Researcher abc-paper@outlook.com Accepted for presentation at AdvML-Frontiers x CoTMA, a non-archival workshop at COLM 2026. Abstract A personal language agent learns a fact from one audience and may later place it in the prompt it assembles for another. This memory-to-context step is an attack surface: ambiguous or inconsistent channels, cross-audience prying, and poisoned memory can each cause the system to assemble context containing a fact relevant to the query yet unauthorized for the current viewers. We introduce authorization before context: a single, anti- monotone audience-membership rule applied at the memory-to-context transition. Each item carries the audience present when it was recorded; the current viewer set is read from channel metadata and falls back to public when ambiguous; and the item is admitted only when every cur- rent viewer already belonged to its audience. We prove that this rule gives every participant cross-channel recall while ensuring, by exclusion rather than by model behavior, that nothing recorded for a narrower audience reaches a broader one and that poisoned memory cannot widen its own audience. The boundary is a model-neutral invariant on the exact assembled context: a forbidden fact must be absent before the model is called. On a synthetic Contextual-Integrity suite, no forbidden fact entered the context our boundary assembled, whereas unscoped baselines included such facts by construction; we further audit that every read path fails closed. The evidence is preliminary and synthetic. 1 Introduction Persistent memory shifts the security boundary of a personal language agent. Such an agent is a delegated proxy for its owner, much like a human executive assistant. It can hold private conversations with the owner and, on the owner’s behalf, participate in one-to-one and group conversations with external contacts. Each prompt it assembles draws on sources such as recent messages, long-term memory, and retrieved knowledge (Packer et al., 2024; Chhikara et al., 2025; Rasmussen et al., 2025). The resulting threat is compositional and arises at the interaction layer: a fact learned in one conversation can be summarized, stored, retrieved on a later turn, and then included in the prompt assembled for a different audience. When a member of that later audience is itself an agent, this cross-audience exposure is a memory-layer instance of inter-agent trust exploitation. Memory-augmented agents are known to leak private information or to be compromised through shared memory, retrieved experience, poisoned records, and tool arguments (El Yagoubi et al., 2026; Chen et al., 2024; Srivastava & He, 2025; Pulipaka et al., 2026; Zhang et al., 2026; Wang et al., 2026). The principle we adopt is that memory should follow its audience, not the channel that carries it. Three common designs are insufficient. (i) Relevance-only retrieval ranks memory by how well it matches the query and is blind to who may see an item on the current turn (Packer et al., 2024; Chhikara et al., 2025). (i) Output filtering acts only after the prompt has been built and read by the model, so the unauthorized fact is already in its context; redacting the response 1 arXiv:2608.17148v1 [cs.CR] 17 Aug 2026 Author preprint. cannot undo that exposure, and scoring the answer cannot detect it, because the model can answer acceptably even on forbidden input (Mireshghallah et al., 2025). (i) Product-level isolation side-steps the question instead of answering it. Some frameworks silo memory by user, agent, session, or namespace (LangChain, 2026; Mem0, 2026; Zep, 2026; Letta, 2026), and self-hosted personal agents keep one global store but use an allowlist to gate who may converse (OpenClaw contributors, 2026; Nous Research, 2026). Principal-scoped retrieval is a finer variant that tags memory by user and filters reads to that user (LangChain, 2026; Mem0, 2026). But a user can belong to several audiences. A per-user tag cannot distinguish one-to-one facts from group facts involving the same user. None of these systems uses the audience (those present at recording time) as the unit, so the core question stays open: when a durable fact is visible to exactly some participants, which later prompts may include it? We answer with an authorization boundary at the memory-to-context transition that ad- dresses the three gaps directly. Against relevance-only retrieval, it admits by audience membership rather than by relevance. Against output filtering, it decides admission before the prompt is assembled, so no unauthorized fact ever reaches the model. Against per-silo mem- ory, it keeps one shared store yet confines each item to its audience, so participants still recall their own facts across channels. Mechanically, an item’s audience is fixed at record time from the authenticated membership of its source conversation and re-checked at assembly: an item is admitted only when every current viewer already belonged to its audience, with the viewer set read from channel metadata and resolved to public when ambiguous. Admission is decided by membership rather than by a viewer’s type, so human and agent viewers are treated alike. Because audiences are sets, the check is a Zanzibar-style relationship test (Pang et al., 2019; Cutler et al., 2024) grounded in Contextual Integrity (Nissenbaum, 2004), moved from object access to prompt-context assembly. To our knowledge, no prior memory system combines these three properties: an admission decision based on the audience membership of a turn’s participants, with the viewer set read from the transport rather than supplied as an authoritative policy, and resolved fail-closed; a single rule that is at once recall-preserving and one-way confining; and a model-neutral check on the exact assembled context. Filtering reads before assembly is not itself new (Rezazadeh et al., 2025); the contribution is this basis and these guarantees in combination. Concretely, we contribute: (1) an audience-membership boundary whose single admission rule we prove yields both per-participant cross-channel recall and one-way confidentiality; (2) a portable, model-neutral invariant on the exact assembled context, enforced by exclusion rather than by redaction or output scoring; (3) implementation-grounded authorization traces on a synthetic suite, in which a single audience decision governs three structurally different memory stores, together with a read-path fail-closed audit and an internal, human- reviewed live-verification process; and (4) a disclosure-safe artifact and a positioning against access-controlled-memory systems and contextual-integrity benchmarks. We claim only that, in the evaluated configuration, no known forbidden fact entered unauthorized context and every audited read path failed closed; action safety, audience widening, and memory quality are out of scope or future work. 2 Threat model We consider a personal agent that serves one owner across private and shared channels. The assets to protect are the information exchanged in each conversation, whether owner-private, one-to-one, or group; any memory the agent derives from it; the exact context assembled for each model call; and the audience labels and provenance that justify what is included. We assume three threats: cross-audience prying, in which participants elicit facts from a scope they do not belong to; channel ambiguity, in which an inconsistent participant set leads a naive system to over-share; and poisoned memory, in which content planted in one scope later reaches a viewer outside that scope (Chen et al., 2024; Srivastava & He, 2025; Pulipaka et al., 2026). These map to sensitive-information disclosure, broken access control, and memory/RAG poisoning in current taxonomies (OWASP GenAI Security Project, 2025; He et al., 2026a; Cui et al., 2026; Huang et al., 2026). 2 Author preprint. Audience-tagged memory Group chat (Alice, Bob, Charlie) Ambiguous viewer 1:1 Chat (Bob) 1:1 Chat (David) Viewer determination Viewer (Alice, Bob, Charlie) Public-only fallback Viewer (Bob) Viewer (David) Authorization before context Current viewers V(C) ambiguous ⇒ public-only Items tagged: o, David Items tagged: o, Bob Items tagged: o, Alice, Bob, Charlie Items tagged: Public Admit only if current viewers are within the item’s audience Poisoned memory Cross-audience prying is refused Authorized assembled context Model call Exact-context + provenance Planted item cannot reach viewers outside recorded audience Figure 1: Authorization before context. Channel metadata resolves current viewers, with ambiguity falling back to public-only context. Audience-tagged items are admitted only when all current viewers are within the recorded audience; prying is refused, poisoned memory cannot reach outside that audience, and exact-context provenance records the admitted context. The trust boundary we study is the point where stored memory is assembled into a turn’s prompt context (Figure 1). Once an unauthorized item is in that context, later defenses are too late: the model has already read it. We therefore make the boundary checkable before the model is called. Its guarantees are deliberately narrow: retrieval fails closed when the viewer set is uncertain; admission is by audience membership, not content redaction; and the invariant is model-neutral, failing whenever a forbidden fact enters the context regardless of what the model then says. This paper addresses that read boundary only. We assume the transport correctly names a conversation’s participants, and we do not attempt a general defense against prompt injection; the audience rule instead contains planted content, limiting any poisoned item to viewers already within the audience it was recorded for (property P4 below). 3 The audience-membership boundary In our design, all memory lives in one shared, audience-tagged store: several structurally different stores hold the items, but a single audience decision governs them as one. Each memory item, a fact the agent has recorded from a conversation, carries the audience that was present when it was recorded. An audience is identified by its resolved member set, not by the channel or thread it is observed on; two turns share a scope whenever their members coincide, even across different channels or threads. The public audience is a reserved value that denotes all participants and is the default for information any viewer may see. A single conversation turn defines a containerCwith a set of current viewersV(C); before the agent assembles the prompt it will send on that turn, each candidate memory item is authorized against V(C). A memory item F with audience Aud(F) is admissible iff V(C)⊆ Aud(F), that is, every current viewer already belonged toF’s audience. The viewer set is read from channel metadata (sender, container, observed participants); when that evidence is missing or inconsistent, it is treated as unknown and authorization fails closed to public-only. Admission is by exclusion: an unauthorized item is never placed in the context, independent of any model. Formal properties. LetUbe the set of participants, with a distinguished ownero ∈ U, and letMbe the set of memory items. Each itemm∈ Mhas an audienceAud(m)⊆ Uthat contains the owner (o ∈ Aud(m)); the public items are those whose audience is everyone, Pub = m ∈ M : Aud(m) = U. A containerC(one conversation turn) has a current- 3 Author preprint. o, B, A (group) o, B (Bob 1:1)o, A (Alice 1:1) o (owner) Figure 2: Audience lattice. A fact with audienceAenters a containerCiffV(C) ⊆ A: admission flows downward (arrows) to smaller current audiences and never upward. Bob’s one-to-one (o,B) admits a group fact (o,B,A), but the group never admits a fact whose audience iso, B; the owner (o) is at the bottom and sees the union. viewer set V(C)⊆ U and admits Adm(C) = m∈ M : V(C)⊆ Aud(m). Public items are admitted automatically, sinceV(C)⊆ U = Aud(m). WhenV(C)cannot be determined, the fail-closed rule sets V(C) = U, so Adm(C) = Pub. Four properties follow. P1 (one-way confinement). By the rule, admission entitles every current viewer: m∈ Adm(C) =⇒ V(C)⊆ Aud(m). Hence an item never reaches a viewer outside its audience, and nothing recorded for a narrower audience reaches a broader one. P2 (anti-monotonicity). A smaller current audience admits at least as much, V(C 1 )⊆ V(C 2 ) =⇒ Adm(C 2 )⊆ Adm(C 1 ). A one-to-one with a contactc, whereV(C) =o,c, thus recalls every item whose audience includesc, across all channels; a group never surfaces a fact whose audience excludes a member; and the owner, whereV(C) =o, sees the union of all items (Figure 2). A single rule yields both: confinement (P1) within a container, recall (P2) across containers. P3 (fail-closed soundness). Under ambiguityV(C) = U, soAdm(C) = Puband no non-public item is admitted. P4 (poisoning containment). Write-time binding fixes an injected item’s audience to its origin container ’s authenticated membershipA, independent of the item’s content:Aud(m ′ ) = A. By P1, m ′ ∈ Adm(C) =⇒ V(C)⊆ A, so a planted item reaches only viewers already withinAand cannot enlarge its own audience. P4 is a confidentiality property, not an integrity guarantee: planted content may still reach viewers already within its recorded audience, including the owner, but it cannot cause an unauthorized memory item to enter the assembled context. These properties hold for the rule; Section 5 checks that the implementation realizes them. We keep the raw record, derived memory, and exact prompt as distinct layers linked by provenance, so that each admission is measurable: an exact-context snapshot shows what entered the prompt, a provenance link ties each item to its source and audience, and an authorization trace records why it was admitted or why the turn fell back to public-only (Figure 1). Because the snapshot is captured at the model-request boundary, the inclusion invariant is checked against exactly what is assembled rather than a reconstruction, and the same capture point makes the boundary auditable on live traffic, not only in the benchmark. 4 Evaluation protocol Evaluation uses a fixed-seed synthetic generator that assigns Contextual-Integrity labels (subject, sender, recipient, information type, transmission principle) to facts and audi- ences (Nissenbaum, 2004); no real messages are used. The evaluated configuration runs 4 Author preprint. Adversarial settingScen.Forbidden incl.Fail-closed owner-private (private→shared pressure)80– exact shared (one-to-one, group)160– directional cross-channel40– trusted canonical shared404/4 ambiguous / unknown viewer606/6 mixed-inbound (inconsistent evidence)606/6 adversarial boundary80– negative control100– other (public, write-admission, temporal, optional)170– all 79 scenarios790 16/16 Table 1: Red-team results by setting (cited reportrun1780535616e37d6e1c, rev.7452d12b); the rows partition all 79 scenarios from the full 13-family suite, the final row grouping families that have no fail-closed cases. Model-neutral assertions pass 253/253, the per-query conjunction of these decision checks, not a separate measurement. with scope authorization active on every read path. The cited report uses seed 42617 and 79 scenarios across 13 families spanning owner-private, exact-shared, directional cross-channel, fail-closed, adversarial, and poisoning settings. The boundary metric is unauthorized context inclusion, the number of forbidden facts in the exact-context artifact, counted before any answer. We also report the agreement between the observed authorization decision and the expected audience policy, the fail-closed coverage, and the permitted-context coverage. Provenance, decision, and source-plane labels are not a coverage result but a guarantee of the artifact schema: the architecture attaches them to every admitted item, making each admission auditable. Baselines are definitional projections over the same scenarios, not tuned runtimes: an unscoped projection returns all expected context and therefore includes the forbidden facts by construction, marking the upper bound on leakage that the audience rule must drive to zero. Beyond the synthetic suite, we audit that every prompt-context read path resolves authorization before assembly. The reported results rest on sealed synthetic and redacted artifacts whose digests support independent verification without access to production source. Appendices B–D present the sealed run, the claim-to-evidence closure, and one end-to-end synthetic scenario. 5 Results No forbidden fact entered unauthorized context under any adversarial setting: 0 of 79 scenarios (Table 1). A hermetic run that exercises the real read path without a model reproduces this 0/79, so the boundary metric is observed on the assembly path, not only projected. The observed authorization decision matched the expected audience policy in all 79 scenarios, fail-closed coverage was 16/16, and permitted-context coverage was 79/79. The adversarial-boundary and write-admission families, covering planted-content and storage-binding cases, exercise P4: an item recorded under one audience never surfaced in a context containing a viewer outside its origin audience, consistent with write-time binding of its audience to the origin membership; an indeterminate source membership is refused rather than bound to a guessed audience. We then audited every retrieval path that can place memory into a prompt. A single audience decision, derived from the current viewers, governs three structurally different stores: an in- turn recency buffer, a summarized long-term store, and a knowledge graph, each enforcing it at a different point. Recent-message recall is confined to the current turn; the summarized long-term reads push the authorized scopes into the query, so only admissible items are fetched and the assembled context is filled with authorized facts rather than thinned by later removal; and graph retrieval, comprising hybrid search and direct entity lookup, alone fetches first and then drops any item whose audience cannot be checked. The direct- lookup primitive enforces the audience check internally, filtering its results against the 5 Author preprint. authorized scopes before returning, so the guarantee holds by construction rather than by caller convention; it returns an identical not-found response whether an entity is absent or merely unauthorized, an existence opacity. Every path is therefore fail-closed, realizing P1 and P3. One surface resists per-item authorization: a knowledge-graph entity summary is an aggregate that may span audiences and carries no per-item provenance, so it cannot be checked fact-by-fact; we therefore fail closed here as well, withholding such summaries from non-owner readers rather than admitting content we cannot authorize. Beyond the synthetic suite, an internal, human-reviewed live-regression fixture captured the exact assembled context across repeated primary and fallback runs of a real, pinned model, and its row-by-row comparison matched the human-approved baseline; we hold this evidence internally, but the verification records (approvals and content digests) are releasable after review. 6 Related work and limitations The closest prior system is Collaborative Memory (Rezazadeh et al., 2025), which also keeps a shared, provenance-tracked store and filters views before assembly. We differ on three axes. Access unit: ours is the audience membership of conversation participants rather than a capability graph over agents and resources; this membership basis yields the anti- monotone recall and one-way confinement proved above. Viewer evidence: ours is read from the transport and resolved fail-closed, whereas their permission graph is taken as authoritative input. Enforcement: ours admits by exclusion and is judged by a model-neutral inclusion invariant, whereas theirs redacts fragments and is judged by task utility. CIMemories (Mireshghallah et al., 2025) benchmarks contextual integrity of persistent memory but scores violations in model output; AgentLeak, MAGPIE, memory extraction, and channel-leakage work likewise audit outputs or recovered data (El Yagoubi et al., 2026; Juneja et al., 2025; Wang et al., 2025; Cui et al., 2026; Huang et al., 2026). We instead check the assembled context before model output, preventing leaks by construction. Memory benchmarks and systems study multi-session tasks, organization, and durable recall (He et al., 2026b; Shutova et al., 2026; Hu et al., 2025; Yang et al., 2026; Xu et al., 2026; Packer et al., 2024; Chhikara et al., 2025; Zhong et al., 2023; Rasmussen et al., 2025); we make no recall, isolation, or answer-quality superiority claim. Agent-memory security surveys find confidentiality underexplored relative to integrity and poisoning (Lin et al., 2026); our work targets that gap. Self-hosted personal agents such as OpenClaw (OpenClaw contributors, 2026) and Hermes Agent (Nous Research, 2026) authorize who may converse and serve those conversations from one global memory; we instead admit each item only to audiences that already contained it. Zanzibar, Cedar, and Contextual Integrity supply the authorization- before-access and information-flow vocabulary we adapt (Pang et al., 2019; Cutler et al., 2024; Nissenbaum, 2004). The data are synthetic. Because the boundary is a deterministic membership test rather than a model behavior, its zero-leakage result holds by construction rather than by measured attack success. Audience widening, the promotion of facts that several contacts indepen- dently know into a shared audience, is the recall-completeness dual of leakage and may be worth exploring in future work. We deliberately accept overblocking rather than infer such unions, because widening would re-introduce content inference, and thus leakage risk, into an otherwise content-free boundary; doing it safely would require inferring ac- cess relationships beyond the static tuples that authorization systems assume. We make no production-reliability, latency, user-study, deletion, conflict-resolution, action-safety, or memory-quality claims; we do not release the production system or its source, though the synthetic benchmark, evaluator, schemas, and redacted artifacts are disclosure-safe and releasable, and the live-verification process is internal operational support rather than a public live-efficacy claim. Future work.Three directions remain. First, coverage should deepen by driving the same audience decision through every store we claim, including graph-backed retrieval, which this hermetic run audits as a read path but does not yet exercise as seeded benchmark mate- 6 Author preprint. rial. Second, write admission should be evaluated as a measured boundary, generalizing P4’s containment of planted content from read-time exclusion to record-time binding. Third, evaluation should broaden to a larger adversarial suite spanning forged metadata, stale labels, multi-hop transitions, and overlapping audiences, with executable baselines that expose which boundary each alternative lacks rather than serve as a leakage leaderboard. References Zhaorun Chen, Zhen Xiang, Chaowei Xiao, Dawn Song, and Bo Li. Agentpoison: Red- teaming llm agents via poisoning memory or knowledge bases, 2024. URLhttps:// arxiv.org/abs/2407.12784. Prateek Chhikara, Dev Khant, Saket Aryan, Taranjeet Singh, and Deshraj Yadav. Mem0: Building production-ready ai agents with scalable long-term memory, 2025. URLhttps: //arxiv.org/abs/2504.19413. Yu Cui, Ruiqing Yue, Hang Fu, Sicheng Pan, Zhuoyu Sun, Baohan Huang, Haibin Zhang, Cong Zuo, and Licheng Wang. Spore: Efficient and training-free privacy extraction attack on llms via inference-time hybrid probing, 2026. URLhttps://arxiv.org/abs/ 2604.23711. Joseph W. Cutler, Craig Disselkoen, Aaron Eline, Shaobo He, Kyle Headley, Michael Hicks, Kesha Hietala, Eleftherios Ioannidis, John Kastner, Anwar Mamat, Darin McAdams, Matt McCutchen, Neha Rungta, Emina Torlak, and Andrew Wells. Cedar: A new language for expressive, fast, safe, and analyzable authorization (extended version), 2024. URL https://arxiv.org/abs/2403.04651. Faouzi El Yagoubi, Godwin Badu-Marfo, and Ranwa Al Mallah. Agentleak: A full-stack benchmark for privacy leakage in multi-agent llm systems, 2026. URLhttps://arxiv. org/abs/2602.11510. Yu He, Haozhe Zhu, Yiming Li, Shuo Shao, Hongwei Yao, Zhihao Liu, and Zhan Qin. Attriguard: Defeating indirect prompt injection in llm agents via causal attribution of tool invocations, 2026a. URL https://arxiv.org/abs/2603.10749. Zexue He, Yu Wang, Churan Zhi, Yuanzhe Hu, Tzu-Ping Chen, Lang Yin, Ze Chen, Tong Arthur Wu, Siru Ouyang, Zihan Wang, Jiaxin Pei, Julian McAuley, Yejin Choi, and Alex Pentland. Memoryarena: Benchmarking agent memory in interdependent multi-session agentic tasks, 2026b. URL https://arxiv.org/abs/2602.16313. Yuanzhe Hu, Yu Wang, and Julian McAuley. Evaluating memory in llm agents via incre- mental multi-turn interactions, 2025. URL https://arxiv.org/abs/2507.05257. Tao Huang, Chen Hou, Guosen Wu, and Jiayang Meng. Observable channels, not just storage: Evaluating privacy leakage in llm agent pipelines, 2026. URLhttps://arxiv. org/abs/2603.22751. Gurusha Juneja, Jayanth Naga Sai Pasupulati, Alon Albalak, Wenyue Hua, and William Yang Wang. Magpie: A benchmark for multi-agent contextual privacy evaluation, 2025. URL https://arxiv.org/abs/2510.15186. LangChain. Langgraph memory, 2026. URLhttps://docs.langchain.com/oss/python/ langgraph/add-memory. Letta.Introduction to stateful agents, 2026.URLhttps://docs.letta.com/guides/ core-concepts/stateful-agents. Zehao Lin, Chunyu Li, and Kai Chen. A survey on the security of long-term memory in llm agents: Toward mnemonic sovereignty, 2026. URL https://arxiv.org/abs/2604.16548. Mem0. Entity-scoped memory, 2026. URLhttps://docs.mem0.ai/platform/features/ entity-scoped-memory. 7 Author preprint. Niloofar Mireshghallah, Neal Mangaokar, Narine Kokhlikyan, Arman Zharmagambetov, Manzil Zaheer, Saeed Mahloujifar, and Kamalika Chaudhuri. Cimemories: A compo- sitional benchmark for contextual integrity of persistent memory in llms, 2025. URL https://arxiv.org/abs/2511.14937. Helen Nissenbaum. Privacy as contextual integrity. Washington Law Review, 79(1):119–158, 2004. URL https://digitalcommons.law.uw.edu/wlr/vol79/iss1/10/. Nous Research. Hermes agent: A self-hosted personal agent with persistent memory. https://github.com/NousResearch/hermes-agent, 2026. Open-source software; accessed 2026. OpenClaw contributors. OpenClaw: A self-hosted personal AI assistant.https://github. com/openclaw/openclaw, 2026. Open-source software; accessed 2026. OWASPGenAISecurityProject.Owasptop10foragenticapplica- tions2026,December2025.URLhttps://genai.owasp.org/resource/ owasp-top-10-for-agentic-applications-for-2026/. Charles Packer, Sarah Wooders, Kevin Lin, Vivian Fang, Shishir G. Patil, Ion Stoica, and Joseph E. Gonzalez. Memgpt: Towards llms as operating systems, 2024. URLhttps: //arxiv.org/abs/2310.08560. Ruoming Pang, Ramon Caceres, Mike Burrows, Zhifeng Chen, Pratik Dave, Nathan Germer, Alexander Golynski, Kevin Graney, Nina Kang, Lea Kissner, Jeffrey L. Korn, Abhishek Parmar, Christina D. Richards, and Mengzhi Wang. Zanzibar: Google’s consistent, global authorization system. In 2019 USENIX Annual Technical Conference (USENIX ATC 19), p. 33–46. USENIX Association, 2019. URLhttps://w.usenix.org/conference/atc19/ presentation/pang. Sidharth Pulipaka, Stanislau Hlebik, Leonidas Raghav, Sahar Abdelnabi, Vyas Raina, Ivaxi Sheth, and Mario Fritz. Hidden in memory: Sleeper memory poisoning in llm agents, 2026. URL https://arxiv.org/abs/2605.15338. Preston Rasmussen, Pavlo Paliychuk, Travis Beauvais, Jack Ryan, and Daniel Chalef. Zep: A temporal knowledge graph architecture for agent memory, 2025. URLhttps://arxiv. org/abs/2501.13956. Alireza Rezazadeh, Zichao Li, Ange Lou, Yuying Zhao, Wei Wei, and Yujia Bao. Collabo- rative memory: Multi-user memory sharing in llm agents with dynamic access control, 2025. URL https://arxiv.org/abs/2505.18279. Alina Shutova, Alexandra Olenina, Ivan Vinogradov, and Anton Sinitsin. Evaluating memory structure in llm agents, 2026. URL https://arxiv.org/abs/2602.11243. Saksham Sahai Srivastava and Haoyu He. Memorygraft: Persistent compromise of llm agents via poisoned experience retrieval, 2025. URLhttps://arxiv.org/abs/2512.16962. Bo Wang, Weiyi He, Shenglai Zeng, Zhen Xiang, Yue Xing, Jiliang Tang, and Pengfei He. Unveiling privacy risks in llm agent memory, 2025. URLhttps://arxiv.org/abs/2502. 13172. Hongtao Wang, Se Yang, Yu Chen, and Puzhuo Liu. Hijacking agent memory: Stealthy trojan attacks through conversational interaction, 2026. URLhttps://arxiv.org/abs/ 2605.29960. Wujiang Xu, Yu Wang, Kai Mei, Kaiqu Liang, Zhenting Wang, Mingyu Jin, Han Zhang, Shi-Xiong Zhang, Wenyue Hua, Sambit Sahu, and Dimitris N. Metaxas. Memgym: a long-horizon memory environment for llm agents, 2026. URLhttps://arxiv.org/abs/ 2605.20833. Jingbo Yang, Kwei-Herng Lai, Xiaowen Wang, Shiyu Chang, Yaar Harari, and Evgeniy Gabrilovich. Groupmembench: Benchmarking llm agent memory in multi-party conver- sations, 2026. URL https://arxiv.org/abs/2605.14498. 8 Author preprint. Zep. Zep key concepts, 2026. URL https://help.getzep.com/v2/concepts. Xuanye Zhang, Yongsen Zheng, Zhuqin Xu, Kaiyu Zhou, Bowen Shen, Haoran Ou, Tianwei Zhang, and Kwok-Yan Lam. Memmorph: Tool hijacking in llm agents via memory poisoning, 2026. URL https://arxiv.org/abs/2605.26154. Wanjun Zhong, Lianghong Guo, Qiqi Gao, He Ye, and Yanlin Wang. Memorybank: Enhanc- ing large language models with long-term memory, 2023. URLhttps://arxiv.org/abs/ 2305.10250. Ethics, reproducibility, and AI-use disclosure This paper evaluates synthetic or redacted boundary artifacts and does not publish private messages, prompt bodies, provider settings, or cloneable deployment details. The cited report is generated from fixture-seeded benchmark runs and records source revision, com- mand, artifact digests, disclosure levels, and replay metadata; live-verification artifacts are used as operational and accountability support, not as disclosure of private live traces. All artifacts shown in the appendices are synthetic or redacted excerpts of the sealed evidence package. AI disclosure: this manuscript was prepared with assistance from AI-powered writing and coding tools for drafting, revision, citation-format cleanup, and figure integration. The author directed the claims, evidence selection, and limitations, and remains responsible for the accuracy of all text, citations, figures, and conclusions, which require author review before submission. A Related-work comparison Table 2 summarizes how the audience-membership boundary relates to the closest prior systems and authorization frameworks, without exposing private implementation detail. Comparison areaRepresentative workBoundary relative to this paper Access-controlled shared memory Collaborative MemoryCapability graph + utility eval; ours is audience membership + exclusion + model-neutral inclu- sion invariant. Contextual-integrity / leakage CIMemories, AgentLeak, MAG- PIE Output- or extraction-scored; ours is checked on assembled context before scoring. Memory benchmarksMemoryArena, StructMemEval, MemoryAgentBench,Group- MemBench, MemGym Task/organization/recall; ours is an audience-boundary invari- ant. Memory systemsMemGPT, Mem0, MemoryBank, Zep Durable memory; we make no backend-superiority claim. Self-hostedpersonal agents OpenClaw, Hermes AgentAllowlist gating of who may con- verse, then one global memory; ours adds per-item audience con- finement. Authorization / privacy models Zanzibar, Cedar, Contextual In- tegrity Vocabulary we adapt to prompt- context assembly. Table 2: Related-work comparison dimensions. 9 Author preprint. B Reproducibility and artifact seal This appendix summarizes the sealed evidence package behind the reported numbers. The seal captures the run identifier, source revision, generator seed, metric numerators and denominators, and public artifact digests. It is an integrity record for the synthetic and redacted evidence package, not a release of production source or private runtime traces. FieldValue Run id run1780535616e37d6e1c Report id scope-aware-memory-1780535616 Source revision 7452d12b4111c4367f98fafa67c4af77c8323e40 Generator seed42617 Scenario families / scenarios / queries13 / 79 / 79 Authorization decision match79/79 Permitted-context coverage79/79 Forbidden context inclusion0/79 Fail-closed coverage16/16 Model-neutral assertions253/253 Retained supplement digest 16146054... Table 3: Durable citation seal for the reported implementation-tier run. Public artifact familyRecordsSHA-256 prefix baselinereport12 f10c9e74 modelneutralassertions253 219bbab0 authorization trace79 74f663fc exactcontextsnapshot79 3038be23 execution diagnostics1 a836dbd5 expectedcontextpolicy79 1554747c synthetic inputevents83 3d6dc8ef observationmodemetrics2 8a1a2726 provenancetrace79 4909c4ec unscoped baselinecontextartifacts79 1ea41aec observedcontextartifacts79 749ddc0c scenario manifest1 814461ba seededmaterialartifacts79 c47bbba6 synthetic statesnapshot79 45084623 writeadmissiontrace4 f075cba4 Table 4: Public artifact families in the retained evidence package. Prefixes are computed over the public projection files listed in ARTIFACTINDEX.json. 10 Author preprint. Figure 3 contrasts the evaluated boundary with two baselines inbaselinereport. The unscoped real-path baseline disables authorization and therefore leaks; the one-store group is a synthetic diagnostic projection, not the full method, showing that scoping only one store can preserve confidentiality while dropping allowed context. facts 0 20 40 60 79 0 79 full boundary 7979 real unscoped 0 76 diagnostic one-store forbidden admitted allowed retained Figure 3: Baseline contrast over 79 scenarios. The full boundary retains 79/79 allowed facts while admitting 0/79 forbidden facts. The unscoped real-path baseline retains the same allowed facts but admits 79/79 forbidden facts by construction. The diagnostic one-store projection also admits 0/79 forbidden facts, but retains only 76/79 allowed facts because it omits allowed facts outside that single store; it is not the evaluated full boundary. 11 Author preprint. C Claim-to-evidence closure Each paper claim is tied to machine-readable artifacts rather than to prose-only assertions. Table 5 lists the public artifact families used to close each claim and the metric or structural check that supports it. Claims outside this boundary, including action safety, semantic audience widening, production reliability, and broad memory quality, are excluded or left as future work. Claim surfaceEvidence artifactsClosure check Retrieval and prompt- context boundary authorizationtrace, observedcontextartifacts, modelneutralassertions 79/79 authorization decisions matched; 0/79 forbidden in- clusions. Raw-to-context prove- nance exact contextsnapshot, provenancetrace Every admitted item carries source and audience prove- nance. Observed source attribu- tion observedcontextartifacts, baselinereport Eachobservedprompt- context item is attributed to a source store; unevaluated memory-quality claims re- main excluded. Exact-context supporta- bility exactcontextsnapshot, provenancetrace, observedcontextartifacts The artifacts record what en- tered the prompt and why it was admitted. Model-neutral invariantmodelneutralassertions, authorizationtrace 253/253 pre-answer assertions passed without scoring model output. Table 5: Claim-to-evidence closure used by the paper. 12 Author preprint. D Worked synthetic scenario Table 6 shows selected public artifact fields for one directional cross-channel scenario with the audience boundary disabled and then enabled. Both columns render the same synthetic seed material; the audience boundary is disabled in the unscoped baseline and enabled in the scoped run. For brevity, fact-id references abbreviate the repeated scenario prefix as.... Evidence itemBoundary offBoundary on Policy required=[...groupfact] forbidden=[...aliceonlyfact] same policy Observed artifact unscopedbaselinecontextartifacts observedcontextartifacts Authorization authorization applied=false measurementbasis= benchmarkonlyunscopedprojection observedauthorizationmode= exactshared viewercontactids=[bob] confidence=high Included facts included=[... groupfact, ...aliceonlyfact] included=[...groupfact] Forbidden included [...aliceonlyfact] [] Allowed seed text @@scopefact:...groupfact@@ Synthetic directional group fact 1. @@scopefact:...groupfact@@ Synthetic directional group fact 1. Forbidden seed text @@scopefact:...aliceonlyfact@@ Synthetic directional Alice-only fact 1. absent from assembled context Exact-context snapshotnot emitted as a separate baseline snap- shot row fact id=...groupfact no row for ... aliceonlyfact Pre-answer assertionsnot applicable to unscoped baseline authorization: passed=true forbidden: passed=true allowed: passed=true Table 6: Boundary-off versus boundary-on evidence for one synthetic scenario. With authorization disabled, the unscoped baseline includes the Alice-only fact in the assembled- context section; with authorization enabled, the observed context includes only the group fact, the forbidden-included set is empty, and the exact-context snapshot contains no row for the forbidden fact. 13