ai-memory for cybersecurity — control surface, data integrity, honest threat model

Cross-family joint verdict

Dense real controls. Not certified. Not host-proof. Not zero-config max.

What you can rely on: a shipped trust spine for agent memory — append-only audit chain, surface-scoped attestation, pure recall (reads do not silently rewrite content), secret screening (refuse default when seeded), federation signature gates, webhook SSRF + HMAC, forget tombstones, and an operator-pinable hardened profile.

What max requires: enrolled keys, AI_MEMORY_SECURITY_PROFILE=asi-hard (or equivalent pins), TLS/mTLS, capture discipline, and — for multi-tenant HTTP — per-agent API keys enrolled + AI_MEMORY_HTTP_REQUIRE_ATTESTED_IDENTITY=enforce. The brew-install default is intentionally operable, not procurement-max.

What we never claim: NSA / OWASP / FedRAMP / SOC2 / ISO product certification; host-root tamper-proofing; multi-tenant isolation from a shared API key alone; absolute “never lose data / never wrong memory.”

Full ballots and CodeGraph anchors: Grok Final Verdict §E–§F · Fable 9-claim adjudication.

Point #8 · Data integrity

Durable truth machinery — pure recall hard-passed.

Data integrity here means: stored agent memory stays trustworthy under real operations. It is not a slogan that nothing can ever go wrong.

Sub-axis	Status	Security-relevant note
Pure recall	PASS	Recall does not mutate memory content. Access ladders fold from an append-only observations ledger (post-#1953). Kill-tests green across panels.
Embedding-space integrity	Stronger at v84	Same-dim model-swap silent-wrong-neighbor class closed by default via `embedding_space` provenance + space-checked cosine (Fable §3.3).
Audit chain (V-4)	YES_COND	Cross-row `prev_hash` detects mid-chain edits. Forge-evidence + tail truncation need enrolled keys / witness / off-host sink.
Secret screen	YES_COND	Credential detectors (PEM, cloud keys, GitHub tokens, JWTs…). Default refuse when seeded; federation degrades refuse→redact to preserve CRDT convergence.
Forget / tombstones	YES	Intentional erasure with signed forget tombstones blocking LWW resurrection on federation receive.
OCC / multi-writer	YES_COND	If-Match optimistic concurrency is opt-in; default LWW can clobber concurrent writers.
Power-loss durability	Residual	Default `PRAGMA synchronous=NORMAL` can lose acked WAL tail on hard power cut (consistent, not torn). Set `AI_MEMORY_DB_SYNCHRONOUS=FULL` or `asi-hard`. Not integrity-absence.
Absolute slogans	FAIL as product truth	“Never lose / never wrong” is marketing, not SSOT. ANN ranking remains approximate.

Point #9 · Three crypto-communication legs

How the product actually encrypts and authenticates paths.

LEG 1

Client ↔ daemon

API key auth; TLS / optional mTLS for serve. Non-loopback keyless bind refused. Plain HTTP on loopback remains an operator choice.

YES · CONDITIONAL

LEG 2

Federation peer ↔ peer

Envelope signature, nonce anti-replay, peer enrollment, write/signal/transition/checkpoint attestation. Strict defaults on v1.0.0-line.

YES · STRONG DEFAULTS

LEG 3

Daemon ↔ webhook

Fail-closed SSRF guard (private ranges / DNS). Mandatory HMAC on subscription dispatch. Loopback webhooks opt-in for tests only.

YES

Content attestation (SignableWrite)

HTTP direct

Unsigned store on network surface is fail-closed by default (WriteSurface::HttpDirect). Forged signatures rejected unconditionally.

MCP / CLI

Operator-as-actor by design: unsigned writes land as claimed. Parent process owns MCP stdio trust. Not network multi-tenant AuthN.

Control objectives

Default strength vs hardened production.

Control objective	Product support	Default	Hardened
Data residency	Local SQLite; self-hosted `serve`	Strong	Strong
HTTP authentication	API key; non-loopback keyless refuse	Medium–strong if obeyed	Key + TLS/mTLS
Per-tenant isolation (HTTP)	Per-agent API keys; attested-identity mode	FAIL (shared key)	Keys enrolled + `enforce`
Write attestation	`SignableWrite` + surface scope	HTTP required; MCP/CLI claimed	Signed + bound keys
Audit tamper-evidence	V-4 chain + witness / roles	Hash chain; withhold modes	Enrolled witness + off-host sink
Federation trust	Sig / nonce / enrollment / write-sig lanes	Strict-by-default (v1.0-line)	+ fingerprint pin
Inference egress	`AI_MEMORY_INFERENCE_EGRESS`	`allow`	`loopback-only` / `deny`
Secret screening	refuse / redact / off	refuse when seeded	refuse + asi-hard
Hardened pin set	`asi-hard` security profile	Off	Pins fail-closed family
Supply chain	cargo audit / SBOM surfaces	CI discipline	Org pipeline (no SLSA product claim)

The #1 operational finding

Shared API key is not a tenant boundary.

Default (shared api_key + client-asserted X-Agent-Id): cross-tenant read/mutate of scope=private rows and admin spoofing are in scope for a hostile multi-tenant model. Do not sell or deploy this as SaaS-style agent isolation.

Hardened isolation path: enroll per-agent API keys (ai-memory agents bind-api-key / agent_api_keys table) and set AI_MEMORY_HTTP_REQUIRE_ATTESTED_IDENTITY=enforce. Principal binds to a server-held secret; mismatched identity gets 403.

Foot-gun (Fable §3.2): setting enforce without enrolling per-agent keys can leave the binding apparatus inert. Treat enrollment + enforce as a pair.

MCP stdio is a different trust domain: the parent process is the operator. Network multi-tenant AuthN is the HTTP daemon + edge identity injection — not the chat host channel.

Threat model (panel-aligned)

Realistic outcomes, not fantasy defenses.

Threat	Realistic outcome
Shared-key multi-tenant spoof via `X-Agent-Id`	Default: full cross-tenant risk. Closed only under enrolled keys + enforce.
Unsigned mid-chain rewrite (no keys)	Often detectable via hash chain; whole-suffix rewrite harder without signatures.
Host / root compromise, imaged DB + anchors	Outside product absolute claims. Tamper-evidence, not tamper-proof.
Federation replay	Nonce + sig binding; enrollment gates when enabled.
Forgotten content re-enters via LWW	Forget tombstones block resurrection on receive path when live.
Secret material in store content	Screen refuse/redact; best-effort detectors, not perfect DLP.
Webhook SSRF to cloud metadata	Fail-closed SSRF + mandatory HMAC.
“Air-gapped vault” + public LLM	Cognitive content still leaves host unless egress deny/loopback.
Same-dim embed model swap → wrong neighbors	Closed by default at v84 space provenance.
Power cut under NORMAL sync	Bounded consistent tail-loss possible; FULL / asi-hard closes.
MCP host malware	Parent trust model — harden the host; don’t treat MCP as multi-tenant AuthN.

Recommended production baseline

Ten moves that actually raise the floor.

Never run multi-tenant HTTP on a shared API key alone — enroll per-agent keys + enforce.
Enroll signing / audit / witness keys; verify trails with enrolled-key paths.
Set AI_MEMORY_SECURITY_PROFILE=asi-hard for regulated fleets (know residual knobs not in the pin set).
Front non-loopback with TLS; mTLS for federation where peers are fixed.
Keep federation sig / nonce / enrollment / write-sig requirements on; avoid permanent rollout escapes.
Set AI_MEMORY_INFERENCE_EGRESS=loopback-only or deny when data must not leave the host for inference.
Set AI_MEMORY_DB_SYNCHRONOUS=FULL when every acked write must survive power loss.
Treat MCP/CLI as operator-as-actor; put network multi-tenant at the HTTP edge.
Operate capture/store policy so continuity is real (saved work survives session death).
Quote only kill-list-compliant language in RFPs — mapping, not certification.

# Illustrative hardened env (not a complete policy document)
export AI_MEMORY_SECURITY_PROFILE=asi-hard
export AI_MEMORY_HTTP_REQUIRE_ATTESTED_IDENTITY=enforce
export AI_MEMORY_DB_SYNCHRONOUS=FULL
export AI_MEMORY_INFERENCE_EGRESS=loopback-only
# + enroll per-agent API keys and audit/witness keys before go-live

Claims discipline

Procurement language that will not get you in trouble.

Say this	Never say this
Mapped to NSA CSI MCP guidance; controls structurally addressed; no NSA endorsement	NSA-certified / NSA-approved
OWASP-relevant defenses shipped (SSRF, secrets, injection hygiene, AuthZ machinery)	OWASP Top 10 certified / ASVS L2
FedRAMP/IL5 authorization path (if that is your roadmap language)	FedRAMP-certified deployments (false present-tense)
With per-agent keys + enforce, HTTP isolation binds to server-held secrets	One API key isolates all agents safely
Pure recall: looking up memory does not silently rewrite content	Never lose data / never wrong memory / forever
Vault + notary + rulebook for agent memory	ASI kill switch / the brain / world actuator control

Certification theater — green shields without non-endorsement text fail adversary review.
Default-as-max — brew install is not asi-hard; document the delta.
Host-proof claims — OSS estimable evidence; clone of DB + local anchors remains residual.

Primary references

Load-bearing docs for your security review.

SECURITY.mdThreat model & security policy NSA CSI MCP mappingSelf-assessed structural map · non-endorsed Compliance hubProcurement evidence index Fable 5 adjudicationCross-family 9-claim re-audit Grok 4.5 Final Verdict§E Data integrity · §F Cybersecurity Plain English (cyber section)SME translation of the 9 claims asi-hard templateHardened env example PERFORMANCE.mdPower-loss durability disclosure

Sibling audience pages: End users · C-level · Engineers · Operators