Lineage-Aware Memory Governance: A Derivation-Gated Framework for Privacy-Preserving Column-Level Access Control in Enterprise AI Agents

Venkata M Sangaraju; Sudhir Vissa

cs.CROct 5, 2026

Lineage-Aware Memory Governance: A Derivation-Gated Framework for Privacy-Preserving Column-Level Access Control in Enterprise AI Agents

Authors: Venkata M Sangaraju, Sudhir Vissa

Organizations: Independent Researcher · SAGE7 AI, Georgetown, Texas, USA

Abstract

Enterprise AI agents that share a memory store face two unaddressed risks: sensitive data can leak through legitimately computed results the requester could not derive, and departments can silently compute a same-named key performance indicator (KPI) through conflicting logic. Existing agent-memory systems (e.g., MemGPT, Zep, A-MEM) gate retrieval by content, ownership, and role, not derivation, missing a cached insight that embeds a forbidden column. We introduce the Analytical Memory Unit (AMU), a memory schema that attaches a full derivation (lineage) graph to every cached result, gated by a retrieval policy that serves a hit only when the requester is authorised for every column touched. Provided lineage recording is complete, we prove by construction that the policy blocks retrieval of results derived from a sensitive column outside the requester's permissions, at O(n) worst case -- a conditional design guarantee, not an empirical claim, that excludes derived features encoding sensitive information without naming their source. Eliminating measured leakage required 75-90% recorded lineage completeness, so we treat 90% as a conservative deployment target. Across six experiments, lineage-gated retrieval removes the 18.8-25.5% cross-department leakage naive content-gated memory suffers, keeping 81.5-82.6% of memory reuse at 13.8 microsecond worst-case overhead. A real-agent proof-of-concept with LLM-generated SQL is consistent with the guarantee: zero leaks over 9 round-trips, two conflicts caught automatically -- though a feasibility demonstration, not evidence of production viability. This offers a practical governance layer for shared agent memory, complementing source-layer access control and supporting EU AI Act compliance.

Figures & tables

System	Content tag	Role ACL	Column lineage	Drift detect	Retrieval gate
MemGPT	✗	✗	✗	✗	✗
Zep	✓	✗	✗	✗	✗
A-MEM	✓	✗	✗	✗	✗
Governed Memory	✓	✓	✗	✗	✓
SSGM	✓	~	✗	~	✓
Collaborative Memory	~	✓	✗	✗	✓

Table I: Feature comparison of representative agent-memory and governance systems against the Analytical Memory Unit (AMU). “Role ACL” = role-based access-control list. ✓ = supported, ✗ = not supported, ~ = partial/indirect support. Cells reflect each system’s documented design decisions , not independently verified performance; see the note on source provenance following this table.

Panel of Figure 1 — Figure 1: Worked lineage graph: Finance’s churn_rate is derived by joining three source tables. Because the join touches the sensitive column income , the derived tag $\mathrm{S}(a)$ makes this single cached number unsafe to serve to any department lacking income access—even though the value $0.114$ alone reveals nothing.

Field	Description
metric_name	Business KPI name ( e.g. , churn_rate )
value , owner_dept , epoch	Result, producing department, TTL time index
lineage	Derivation graph: sequence of $(t,C,\varphi)$ steps
sensitivity_tags	$\mathrm{S}(a)$ (Eq. 1 ), cached
definition_hash	$\mathrm{H}(a)$ (Eq. 2 ), cached

Table II: Analytical Memory Unit (AMU) schema fields.

Panel of Figure 2 — Figure 2: AMU architecture. An agent’s executed query is intercepted at the database cursor and its lineage extracted (left); the AMU is written to the shared store, where Algorithm checks $\mathrm{H}(\cdot)$ against cross-department entries. On the read path (right), the lineage gate checks $\mathrm{S}(a)\subseteq\mathrm{P}(d)$ before serving from memory; unsafe candidates are blocked and the agent falls back to a fresh in-scope computation, itself written back through the same path.

Operation	Cplx.	$n{=}1$	$n{=}50$
Gate-check predicate	$O(\|\mathcal{S}\|)$	$0.09\,\mu$ s	$0.09\,\mu$ s
Write — conflict detection	$O(n)$	$0.28\,\mu$ s	$1.63\,\mu$ s
Retrieve — worst case	$O(n)$	$0.66\,\mu$ s	$13.82\,\mu$ s
Retrieve — expected case	$O(1)$	$0.66\,\mu$ s	$0.64\,\mu$ s

Table III: Asymptotic complexity and measured latency (means over 2,000 iterations;

k{=}2

–

3

c{=}4

–

7

). Full runtime sweep in the Supplementary Material.

ID	Threat	Status	Production control
T1	Sensitive-column leakage via cached result	Addressed	Lineage gate (Alg. )
T2	Silent metric-definition drift	Addressed	Conflict detector (Alg. )
T3	Stale sensitive data after policy update	Partial	TTL + lazy $\mathrm{S}(a)$ recompute (Cor. 3 )
T4	Inference attacks (undeclared derived features)	No	Manual review of feature engineering; out of scope
T5	Malicious/incomplete lineage fabrication	Partial	Automatic extraction ( SQLGlot /LINEAGEX), § VI-B
T6	Aggregate inference across retrievals	No	Differential privacy layer (future work)

Table IV: Threat summary. “Addressed” means Algorithms – mitigate the threat directly under the stated assumptions; “Partial” means the mechanism reduces but does not eliminate exposure; “No” means an external control is required.

Dept.	Permitted (summary)	Blocked (in $\mathcal{S}$ )
Finance	All columns	None
Marketing	Commercial, order data	ssn, income, email
Support	Customer, ticket meta	ssn, income, email

Table V: Department permissions, synthetic schema. The gate enforces restrictions only on columns in

\mathcal{S}

; non-sensitive blocked columns represent full policy intent but are not currently gate-enforced.

	Synthetic (5-tab.)		TPC-H (8-tab.)
Metric	Naive	LA	Naive	LA
Leak rate (%)	$18.8\pm 3.7$	$0.0\pm 0.0^{\dagger}$	$25.5\pm 4.5$	$0.0\pm 0.0^{\dagger}$
Reuse rate (%)	$95.8\pm 0.0$	$82.6\pm 2.3$	$95.8\pm 0.0$	$81.5\pm 4.8$
Conflict recall (%)	$0.0\pm 0.0$	$100.0\pm 0.0$	$0.0\pm 0.0$	$100.0\pm 0.0$
† Formal guarantee (Theorem 1 ), not an empirical discovery.

Table VI: Leak and reuse rates, both schemas (30 seeds, mean

\pm

std dev). All naive–LA differences: bootstrap 95% CI excludes zero, Mann-Whitney

U

p<0.001

. Full tables in the Supplementary Material.

Figure 3: Synthetic vs. TPC-H schema comparison (30 seeds each). TPC-H’s denser sensitive-column structure yields a higher naive leak rate; lineage-aware gating eliminates leakage in both configurations.

Figure 4: Leak rate vs. lineage completeness

\rho

(30 seeds, mean

\pm

1 std dev shading). Both schemas converge to 0% by

\rho{=}0.75

–

0.90

; at

\rho{=}0.50

the synthetic schema approaches the naive baseline.

Detector	Prec.	Recall	F 1	LO correct
D1 — Exact hash	0.651	1.000	0.789	8/8
D2 — Jaccard ( $\tau{=}0.70$ )	0.676	0.821	0.742	3/8
D3 — Column-graph	1.000	0.714	0.833	0/8

Table VII: Extended fuzzy conflict-detection results (43 pairs). Full per-category breakdown in the Supplementary Material.

Figure 5: Extended fuzzy conflict-detection results. (a) Per-category detection rate: recall for TC/LO/CS, specificity for TV. D3’s perfect specificity on TV collapses to zero detection on LO. (b) Overall $F_{1}$ /precision/recall with 95% bootstrap CI on $F_{1}$ .

Venkata Sangaraju is an independent researcher working on memory and data-governance architectures for enterprise artificial intelligence (AI) agents. His research interests include lineage and provenance tracking for AI agent systems, privacy-preserving retrieval, column-level access control, and the application of formal safety guarantees to shared multi-agent memory infrastructure. He is the corresponding author of this work (ORCID: 0009-0001-7716-1342).

Table 13

Sudhir Vissa is with SAGE7 AI, Georgetown, Texas, USA. His research interests include enterprise AI agent architectures, data governance, and applied infrastructure for multi-agent deployments, including the metric-definition and access-control problems addressed in this work (ORCID: 0009-0003-7865-0863).

Table 14

Explore similar work

AkasicMEM: Governed Enterprise Memory for Agents
Sep 22, 2026Jeongmin Bae, Yongjae Kim, Kyoung Hur +2Peak Memory Enterprise Systems
GraphAI Seoul, Republic of Korea
MemLineage: Lineage-Guided Enforcement for LLM Agent Memory
May 14, 2026Ciyan Ouyang, Rui HouUntrusted Content LLM Defense Mechanisms
State Key Laboratory of Cyberspace Security Defense Institute of Information Engineering, CAS Beijing, China
GateMem: Benchmarking Memory Governance in Multi-Principal Shared-Memory Agents
Jun 17, 2026Zhe Ren, Yibo Yang, Yimeng Chen +7Governance
School of Artificial Intelligence, Jilin University · 2Shanghai Jiao Tong University · 3King Abdullah University of Science and Technology (KAUST) +2

Sep 22, 2026, cs.DBJ/K move · Enter open · S save

AkasicMEM: Governed Enterprise Memory for Agents

Jeongmin Bae, Yongjae Kim, Kyoung Hur, Donghyoung Han+1

GraphAI Seoul, Republic of Korea

Peak Memory Enterprise Systems Authorization

Open paper AskPDF arXiv

Agent memory enables enterprise agents to retain knowledge acquired during work and reuse it across tasks and agents, turning execution experience into persistent organizational knowledge. Realizing this potential requires both source--memory integration, through which enterprise sources and accumulated memory can be utilized together, and memory governance, through which shared memory remains subject to organizational policies throughout its lifecycle. These requirements interact when information from enterprise sources persists in memory. As this information is repeatedly derived and reused under changing principals and policies, source restrictions may be bypassed, resulting in information leakage. Preventing such leakage requires authorization continuity, under which source restrictions remain effective throughout source-to-memory and memory-to-memory derivation and reuse. Existing approaches address these concerns individually, but do not treat source--memory integration, memory governance, and authorization continuity as combined core design targets across the memory lifecycle. We define Governed Enterprise Memory as agent memory designed around this combined scope and present AkasicMEM as its realization. AkasicMEM realizes authorization continuity through transitive lineage, policy composition during memory formation, and policy re-evaluation during retrieval. It is built on GraphAI's AkasicDB, a unified vector--graph--relational database whose storage and execution substrate enables the underlying operations of these mechanisms to be jointly optimized and executed.

Abstract

Explore similar work

AkasicMEM: Governed Enterprise Memory for Agents

MemLineage: Lineage-Guided Enforcement for LLM Agent Memory

GateMem: Benchmarking Memory Governance in Multi-Principal Shared-Memory Agents