Last verified: 28 September 2026

Agent memory — estate-local isolation ceremony

Sovern records every agent memory write into an org-owned store whose decryption key is held by the owning org or — for substrate kernel agents — by the substrate operator. Memory never crosses estate boundaries without an attestation-backed transfer ceremony.

The estate-local invariant (NN-1)

Every public.agent_memory_stores row carries owner_org_id (NOT NULL), environment_id (NOT NULL), and encryption_scope from the closed registry. Every public.agent_memory_records row inherits the store's envelope and is further protected by a restrictive agent_memory_records_environment_match RLS policy. Reading memory across an estate boundary requires a signed transfer manifest (§ZAY J6.NN.7).

Memory write lifecycle

1. Caller invokes agentsService.writeMemoryRecord against an org-owned, environment-bound store.
2. Service validates store ownership matches the owner org of the agent, validates environment match, encrypts the payload using the store's declared encryption scope.
3. Record is inserted with core.api.mutation event emission per Rule 5 + a future-armed agent.memory.record.written typed event (NN-iv).
4. An audit_events ledger row records the write for §EE substrate-operator-observable trail (NN-iv + EE.sub3).

Backends offered (4)

Each store row pins exactly one backend from the closed registry; switching backends after creation requires a signed migration record (deferred §ZAY).

postgres-jsonb — PostgreSQL JSONB

Heap table storage in `public.agent_memory_records` with `content jsonb`. Default at v1; minimal infrastructure footprint.

vector-index — Vector index

Heap table with `embedding vector(1536)` column populated for semantic retrieval (requires pgvector extension; HNSW or IVF index applied post-v1).

external-kv — External key-value

Memory records stored in an external KV store (e.g., Redis, Cloudflare KV) referenced by the row. Per-record TTL supported.

hybrid — Hybrid

Mixed-backend layout: structured records in PostgreSQL JSONB + vector embeddings in pgvector + ephemeral state in external KV. Reserved for high-volume tenants; deferred to §ZBA.

Encryption scopes (3)

The owning org chooses one of the closed encryption scopes at store creation. Substrate kernel agents (substrate-operator-owned) use env-key; org-owned agents default to org-key; compliance-regulated tenants may pin external-managed against their own KMS / HSM.

org-key — Org key

Memory records encrypted with the owning org's KMS key. Default at v1; ensures memory is decryptable only with org-scoped credentials.
key controlled by: org-owner

env-key — Environment key

Memory records encrypted with the environment's master key (substrate-operator-controlled). Used for substrate-managed kernel agents whose owner is the substrate-operator org itself.
key controlled by: substrate-operator

external-managed — External-managed

Memory records encrypted with an external KMS managed by the owning org (e.g., AWS KMS, HashiCorp Vault). Used for compliance-regulated tenants requiring HSM-backed keys.
key controlled by: org-owner

See also /trust/agents for the full §NN substrate disclosure (strata, visibility, manifest, backends, encryption).