Authorization Before Context: A Model-Neutral Audience Boundary Against Cross-Audience Memory Leakage in Agentic Systems

Sibo Liu

cs.CRAug 17, 2026

Authorization Before Context: A Model-Neutral Audience Boundary Against Cross-Audience Memory Leakage in Agentic Systems

Authors: Sibo Liu

Organizations: Independent Researcher

Abstract

A personal language agent learns a fact from one audience and may later place it in the prompt it assembles for another. This memory-to-context step is an attack surface: ambiguous or inconsistent channels, cross-audience prying, and poisoned memory can each cause the system to assemble context containing a fact relevant to the query yet unauthorized for the current viewers. We introduce authorization before context: a single, anti-monotone audience-membership rule applied at the memory-to-context transition. Each item carries the audience present when it was recorded; the current viewer set is read from channel metadata and falls back to public when ambiguous; and the item is admitted only when every current viewer already belonged to its audience. We prove that this rule gives every participant cross-channel recall while ensuring, by exclusion rather than by model behavior, that nothing recorded for a narrower audience reaches a broader one and that poisoned memory cannot widen its own audience. The boundary is a model-neutral invariant on the exact assembled context: a forbidden fact must be absent before the model is called. On a synthetic Contextual-Integrity suite, no forbidden fact entered the context our boundary assembled, whereas unscoped baselines included such facts by construction; we further audit that every read path fails closed. The evidence is preliminary and synthetic.

Figures & tables

Figure 1: Authorization before context. Channel metadata resolves current viewers, with ambiguity falling back to public-only context. Audience-tagged items are admitted only when all current viewers are within the recorded audience; prying is refused, poisoned memory cannot reach outside that audience, and exact-context provenance records the admitted context.

Panel of Figure 2 — Figure 2: Audience lattice. A fact with audience $A$ enters a container $C$ iff $V(C)\subseteq A$ : admission flows downward (arrows) to smaller current audiences and never upward. Bob’s one-to-one ( $\{o,B\}$ ) admits a group fact ( $\{o,B,A\}$ ), but the group never admits a fact whose audience is $\{o,B\}$ ; the owner ( $\{o\}$ ) is at the bottom and sees the union.

Adversarial setting	Scen.	Fail-closed
owner-private (private $\to$ shared pressure)	8	–
exact shared (one-to-one, group)	16	–
directional cross-channel	4	–
trusted canonical shared	4	4/4
ambiguous / unknown viewer	6	6/6
mixed-inbound (inconsistent evidence)	6	6/6

Table 1: Red-team results by setting (cited report run_1780535616_e37d6e1c , rev. 7452d12b ); the rows partition all 79 scenarios from the full 13-family suite, the final row grouping families that have no fail-closed cases. Model-neutral assertions pass 253/253, the per-query conjunction of these decision checks, not a separate measurement.

Appendix figures & tables6 assets

Supplementary material from the paper’s appendix.

Appendix

Comparison area	Representative work	Boundary relative to this paper
Access-controlled shared memory	Collaborative Memory	Capability graph + utility eval; ours is audience membership + exclusion + model-neutral inclusion invariant.
Contextual-integrity / leakage	CIMemories, AgentLeak, MAGPIE	Output- or extraction-scored; ours is checked on assembled context before scoring.
Memory benchmarks	MemoryArena, StructMemEval, MemoryAgentBench, GroupMemBench, MemGym	Task/organization/recall; ours is an audience-boundary invariant.
Memory systems	MemGPT, Mem0, MemoryBank, Zep	Durable memory; we make no backend-superiority claim.
Self-hosted personal agents	OpenClaw, Hermes Agent	Allowlist gating of who may converse, then one global memory; ours adds per-item audience confinement.
Authorization / privacy models	Zanzibar, Cedar, Contextual Integrity	Vocabulary we adapt to prompt-context assembly.

Appendix

Table 2: Related-work comparison dimensions.

Field	Value
Run id	run_1780535616_e37d6e1c
Report id	scope-aware-memory-1780535616
Source revision	7452d12b4111c4367f98fafa67c4af77c8323e40
Generator seed	42617
Scenario families / scenarios / queries	13 / 79 / 79
Authorization decision match	79/79

Appendix

Table 3: Durable citation seal for the reported implementation-tier run.

Public artifact family	Records	SHA-256 prefix
baseline_report	12	f10c9e74
model_neutral_assertions	253	219bbab0
authorization_trace	79	74f663fc
exact_context_snapshot	79	3038be23
execution_diagnostics	1	a836dbd5
expected_context_policy	79	1554747c

Appendix

Table 4: Public artifact families in the retained evidence package. Prefixes are computed over the public projection files listed in ARTIFACT_INDEX.json .

Panel of Figure 3 — Figure 3: Baseline contrast over 79 scenarios. The full boundary retains 79/79 allowed facts while admitting 0/79 forbidden facts. The unscoped real-path baseline retains the same allowed facts but admits 79/79 forbidden facts by construction. The diagnostic one-store projection also admits 0/79 forbidden facts, but retains only 76/79 allowed facts because it omits allowed facts outside that single store; it is not the evaluated full boundary.

Claim surface	Evidence artifacts	Closure check
Retrieval and prompt-context boundary	authorization_trace , observed_context_artifacts , model_neutral_assertions	79/79 authorization decisions matched; 0/79 forbidden inclusions.
Raw-to-context provenance	exact_context_snapshot , provenance_trace	Every admitted item carries source and audience provenance.
Observed source attribution	observed_context_artifacts , baseline_report	Each observed prompt-context item is attributed to a source store; unevaluated memory-quality claims remain excluded.
Exact-context supportability	exact_context_snapshot , provenance_trace , observed_context_artifacts	The artifacts record what entered the prompt and why it was admitted.
Model-neutral invariant	model_neutral_assertions , authorization_trace	253/253 pre-answer assertions passed without scoring model output.

Appendix

Table 5: Claim-to-evidence closure used by the paper.

Evidence item	Boundary off	Boundary on
Policy	required=[..._group_fact] forbidden=[..._alice_only_fact]	same policy
Observed artifact	unscoped_baseline_context_artifacts	observed_context_artifacts
Authorization	authorization_applied=false measurement_basis= benchmark_only_unscoped_projection	observed_authorization_mode= exact_shared viewer_contact_ids=[bob] confidence=high
Included facts	included=[..._group_fact, ..._alice_only_fact]	included=[..._group_fact]
Forbidden included	[..._alice_only_fact]	[]
Allowed seed text	@@scope_fact:..._group_fact@@ Synthetic directional group fact 1.	@@scope_fact:..._group_fact@@ Synthetic directional group fact 1.

Appendix

Table 6: Boundary-off versus boundary-on evidence for one synthetic scenario. With authorization disabled, the unscoped baseline includes the Alice-only fact in the assembled-context section; with authorization enabled, the observed context includes only the group fact, the forbidden-included set is empty, and the exact-context snapshot contains no row for the forbidden fact.

LLM Agent Security

Large language model agent security studies attacks and safeguards for systems that plan, use tools, retain memory, and act across applications.

See all 330 papers

Audience-Bound Persistent Memory: Authorization Across the Memory Lifecycle
Sep 28, 2026Sibo LiuLLM Agent Memory Privacy Leakage in Language Models
Independent Researcher
Agent Memory Is a Surface for Endogenous Authorization Laundering
Sep 1, 2026Tommaso Cerruti, Mika Okamoto, Ansel Kaplan ErolLLM Agent Memory LLM Agent Security
ETH Zurich · Georgia Institute of Technology
Memory Provenance Laundering in LLM Agents: A Non-Amplification Firewall for Persistent Memory
Jul 31, 2026Jinghan Xu, Yiyong Xiao, Wanru Shao +2Agent Memory Poisoning Tool Access Control for LLM Agents

Sep 28, 2026J/K move · Enter open · S save

Audience-Bound Persistent Memory: Authorization Across the Memory Lifecycle

Sibo Liu

Independent Researcher

LLM Agent Memory Privacy Leakage in Language Models Information Flow Control Agent Memory Management

Open paper AskPDF arXiv

A personal language agent that acts for its owner across private and shared conversations can learn a fact from one audience and later place it in the context it assembles for another. We study authorization before context across the whole memory lifecycle. Each memory item carries the audience present when it was recorded; derived items are partitioned by audience, receive the intersection of their sources' audiences, or are suppressed; an audience widens only by an explicit, object-specific grant; and an item enters a model attempt only when every current viewer belongs to one of its authorized audiences, with unresolved viewers failing closed to public-only. Under explicit identity, provenance and complete-mediation assumptions, this admission is sound and policy-complete on the exact assembled context, enforced by exclusion rather than by model behavior. We realize it in two independently persisted reference architectures, a flat store and a relationship graph, and, descriptively, in a native agent-memory runtime. In a prospectively frozen confirmation over 10,000 multi-party histories, no forbidden item entered any architecture's context, whereas unscoped retrieval exposed forbidden items in 82% of its contexts. Entitled recall matched policy-equivalent baselines exactly and exceeded unscoped retrieval by 0.30 Recall@5, with a Holm-confirmed advantage that grows with distractors. No architecture produced a wrong-principal substitution, but unscoped substitutions were too rare to establish the prespecified joint decision.

Abstract

LLM Agent Security

Explore similar work

Audience-Bound Persistent Memory: Authorization Across the Memory Lifecycle

Agent Memory Is a Surface for Endogenous Authorization Laundering

Memory Provenance Laundering in LLM Agents: A Non-Amplification Firewall for Persistent Memory