Gluevenir

Gluevenir gives AI agents the right memory without surrendering control. It scopes recall before the model, preserves approved context, and attaches signed proof to every governed memory action.

Comment

Inspiration

Persistent memory makes AI agents more useful, but it also creates a new control problem. A relevant memory is not automatically an authorized memory. The same information may be appropriate for an internal program lead, require an approved summary for an external partner, or need to be withheld entirely.

Gluevenir also grew from my passion for the intersection of agentic AI, full-stack development, cybersecurity, governance, risk and compliance, and platform engineering. While working toward the AWS Certified Generative AI Developer Professional certification, I wanted to build something that joined those disciplines in a working system rather than treating model behavior, application delivery, security controls, and evidence as separate concerns. The AARM and AIUC-1 frameworks provided a useful lens for turning that goal into concrete runtime protections and inspectable implementation evidence.

I built Gluevenir to answer one question before memory reaches the model:

Should this agent use this memory, in this context, for this purpose, right now?

What it does

Gluevenir is an importable Python framework for useful, governed persistent memory.

Its AARM-inspired Memory Action Gateway evaluates every supported memory action before retrieval or model use. Each action receives exactly one outcome:

  • ALLOW: Authorized memory can be used.
  • MODIFY: Restricted source material is replaced with an exact human-approved Safe Derivative.
  • STEP_UP: The request pauses for an authorized human decision.
  • DEFER: Missing context pauses execution with no side effects.
  • DENY: The request is rejected before restricted memory or a model call is reached.

Every evaluated action produces a canonical Ed25519-signed Recall Receipt containing content-safe IDs, hashes, decisions, reason codes, versions, counts, and verification status.

The Gluevenir Bio demonstration applies this architecture to HX-17, a wholly fictional biotech program. Four synthetic personas explore the same memory corpus through different authorized contexts. The demo shows how legitimate internal knowledge remains useful while restricted details stay inside their intended boundary.

How I built it

CockroachDB Cloud is the persistent operational and vector memory store. Distributed Vector Indexing supports semantic recall, while tenant, program, room, purpose, audience, lifecycle, and approval filters constrain every query. Forced row-level security and a non-owner runtime role provide an additional isolation boundary.

AWS powers the agent runtime. Amazon Bedrock provides embeddings, generation, and Guardrails. AWS Lambda runs the governed agent workflow. AWS Secrets Manager stores runtime credentials and signing material. AWS Amplify hosts the static demonstration, and AWS CDK defines repeatable AMD64 infrastructure.

The model cannot grant itself access, alter policy, or approve a derivative. For external use, Gluevenir mechanically substitutes exact, active, hash-verified human-approved text before model execution.

Microsoft Presidio and deterministic project detectors provide bounded sensitive-data checks. Detection is intentionally treated as imperfect and is never the sole authorization control.

OpenTelemetry traces capture content-safe processing stages, decisions, counts, verification results, and latency. Public read-only Grafana dashboards, Prometheus metrics, and Jaeger-compatible traces make the governed execution path visible without exposing prompts, answers, memory bodies, or customer identifiers.

The repository also includes local, ephemeral, hybrid, and cloud-aligned Docker Compose modes with CockroachDB for repeatable development.

Challenges

The hardest challenge was preserving utility while enforcing strict boundaries. Simply blocking every uncertain memory would have produced a safe but unhelpful system. Safe Derivatives let approved knowledge continue to flow without exposing the restricted source.

Another challenge was making governance understandable. Hashes and policy codes are useful evidence, but they are not a compelling user experience by themselves. The final interface presents the persona, request, candidate memory, authorized context, gateway decision, model answer, and signed proof as one visible agent workflow.

I also had to keep telemetry useful without turning observability into another data-leak path. The resulting traces and dashboards contain bounded metadata rather than raw prompts, responses, detector matches, or memory content.

Accomplishments

  • Implemented all five exclusive gateway outcomes.
  • Preserved useful external responses through exact approved substitution.
  • Enforced tenant and program isolation in CockroachDB.
  • Produced independently verifiable, content-bound Recall Receipts.
  • Demonstrated Bedrock generation, embeddings, Guardrails, and bounded tool use.
  • Added content-safe live OpenTelemetry, Grafana, Prometheus, and trace views.
  • Created a realistic but wholly synthetic biotech corpus with public-source grounding.
  • Mapped implementation evidence to selected AARM, AIUC-1, CSA AICM, ISO, and SOC 2 references without claiming certification or conformance.

What I learned

Memory governance works best as a pre-execution architecture boundary, not as a prompt asking the model to behave.

Authorization and semantic relevance must remain separate. Vector similarity can identify useful candidates, but deterministic policy must decide whether those candidates may cross the boundary.

Evidence is most valuable when it is produced as part of normal execution. Signed receipts and content-safe telemetry make each decision inspectable without requiring raw sensitive content.

What's next for Gluevenir

The highest-ranked next feature is an authenticated human-review workspace for STEP_UP. It will present the exact bounded proposal and evidence, capture a trusted approve or reject decision with expiry and reviewer identity, create a signed resolution receipt, and resume only after fresh policy evaluation. Additional work includes anomalous retry detection after repeated denials, deeper AIUC-1 B005 input-moderation evidence, production key rotation, durable observability storage, additional database scale testing, and broader framework integrations.

Gluevenir Bio is a synthetic demonstration. It is not certified, clinically validated, or a substitute for legal, privacy, security, or compliance assessment. Automated detection remains imperfect.

Built With

  • alembic
  • amazon-bedrock
  • amazon-bedrock-guardrails
  • amazon-ecr
  • amazon-ecs
  • aws-amplify
  • aws-cdk
  • aws-fargate
  • aws-lambda
  • aws-secrets-manager
  • ccloud-cli
  • cloudflare-dns
  • cockroachdb-agent-skills
  • cockroachdb-cloud
  • cockroachdb-managed-mcp
  • distributed-vector-indexing
  • docker-compose
  • github-actions
  • grafana
  • jaeger
  • microsoft-presidio
  • opentelemetry
  • prometheus
  • python
  • sqlalchemy
Share this project:

Updates