MemoryBank lets AI agents share memory while keeping people in control of what that memory allows them to do. It addresses a simple problem: if one agent stores a wrong or unauthorized instruction, another agent might later retrieve it and act on it. Recording who wrote the instruction is useful, but it does not make the instruction trustworthy. Our project separates suggested memory from approved memory. Agents can propose changes, but only an authorized person can make those changes actionable. Every approved memory has an owner scope, a version, an expiry date, and a record of how it was approved. We demonstrate this through two simulated purchasing agents: Muse and Instinct. Muse proposes updates to a shared purchasing policy. Instinct retrieves approved policies and uses them to decide whether to request approval or create a mock draft order. The Shopper controls protected policy changes through an explicit human approval step. The demo begins with a Northstar policy allowing automatic purchases up to USD 5,000. The Shopper requests a USD 7,000 purchase, so Instinct creates a mock approval request. Muse then suggests increasing the limit to USD 10,000. That suggestion is saved as pending review, but it cannot authorize a purchase. Repeating the original request still requires approval. The Shopper then explicitly approves the proposed change using an authorized reviewer session. MemoryBank supersedes v1 and activates v2. When the identical USD 7,000 request is repeated, Instinct creates a mock draft order under the new limit. The request stayed the same; the approved memory changed the permitted action. MongoDB Atlas stores identities, approved memories, proposals, governance events, and execution records. Atlas Vector Search retrieves relevant policies using Voyage AI embeddings. Retrieved results are checked against their current database records before being shared with an agent. Server code enforces permissions, team boundaries, expiry, policy versions, and purchase limits. Chat messages and model output cannot grant administrator privileges. The system also demonstrates isolation and forgetting. Another team cannot retrieve procurement’s private policy. When a memory is forgotten, its content and embedding are removed, and controlled linked records are redacted. Without an applicable approved policy, Instinct must ask for clarification instead of creating another order. Every execution links the user, agent, supporting memory version, validation decision, and purchasing record. The application reads back the external mock record before reporting success, distinguishing a verified result from an attempted action. MemoryBank is a working prototype of accountable shared agent memory. It does not claim to detect every malicious instruction. Instead, it demonstrates enforceable boundaries: a suggestion is not approval, retrieval is not authority, and an agent cannot approve its own memory changes.
Team
