OME MemoryGuard

Durable, auditable memory for AI agents—preserving decisions, evidence, and context across sessions with CockroachDB and AWS.

Comment

Inspiration

Long-running AI agents need memory, but one poisoned, secret-bearing, or unapproved message can become durable context. OME MemoryGuard treats memory as a governed transaction rather than an unchecked prompt-history feature.

What it does

OME MemoryGuard places a deterministic safety gate between an AI agent and persistent memory.

  • Every memory proposal includes its purpose, provenance, namespace, sensitivity, and expiry.
  • A deterministic policy returns active, pending_review, or denied, together with reason codes and a risk score.
  • Denied raw content is never persisted; only safe metadata and a SHA-256 fingerprint enter the audit trail.
  • Sensitive context remains hidden until a human reviewer approves it.
  • Retrieval is restricted by tenant, namespace, lifecycle state, expiry, and sensitivity clearance.
  • Memory changes and their audit events are stored atomically.

How we built it

CockroachDB Cloud is the system of record for governed memories, approval state, agent checkpoints, and audit events. VECTOR(1024) stores embeddings, while tenant and namespace filters enforce isolation before vector ranking.

The AWS environment uses:

  • AWS Lambda and API Gateway for the serverless FastAPI application
  • Amazon Cognito for JWT authentication and PKCE browser sign-in
  • Amazon Bedrock Titan Text Embeddings V2 for embeddings
  • AWS Secrets Manager for fail-closed database configuration
  • Amazon S3 for encrypted, checksummed audit metadata exports
  • AWS SAM for reproducible infrastructure

Challenges we ran into

The hardest challenge was preserving a clear trust boundary across the database, vector retrieval, authentication, and external evidence exports. CockroachDB can atomically store a memory mutation and its audit event, while S3 requires a separately reconciled export.

AWS currently reports a zero applied on-demand quota for Titan Text Embeddings V2. We disclose this limitation rather than claiming a complete live Bedrock retrieval flow.

Accomplishments that we're proud of

  • Fail-closed handling of secrets and persistent prompt injections
  • Tenant-scoped retrieval with sensitivity controls
  • Human approval for conditional memories
  • Atomic memory and audit evidence in CockroachDB
  • JWT-protected AWS deployment
  • A deterministic local demonstration requiring no cloud credentials
  • A live synthetic AWS/CockroachDB verification of proposal storage, audit queries, and encrypted evidence export

What we learned

Safe agent memory is not only vector search. Provenance, lifecycle, expiry, sensitivity, approval state, tenant isolation, and auditability must be enforced before ranking and retrieval.

What's next

  • Complete the bounded Bedrock embedding E2E after AWS activates a non-zero quota
  • Add signed audit chains and export reconciliation
  • Add memory revocation, retention workers, policy versioning, and checkpoint APIs
  • Evaluate multilingual retrieval quality
  • Harden the system for a separate production deployment

Built With

Share this project:

Updates