Lineage-Aware Memory Governance: A Derivation-Gated Framework for Privacy-Preserving Column-Level Access Control in Enterprise AI Agents

Lineage-Aware Memory Governance. A Derivation-Gated Framework for Privacy-Preserving Column-Level Access Control in Enterprise AI Agents. By Venkata M Sangaraju and one other, from Independent Researcher and Sage Seven AI. Published on the fifth of October. Its code repository is worked out: about fifty-five source files, with a readme and a licence.

When enterprise AI agents share one memory store, two risks go unaddressed. The first is leakage through results that were computed legitimately. A cached answer can carry sensitive data that the person now asking could never have derived for themselves. The second is quieter: different departments can compute a key performance indicator with the same name through conflicting logic, and nothing flags it. Existing agent-memory systems, and the authors name MemGPT, Zep, and A-MEM, gate retrieval by content, ownership, and role. None of those looks at how a result was derived, so a cached insight that embeds a forbidden column slips through.

The proposal is the Analytical Memory Unit, or AMU. It is a memory schema that attaches a full derivation graph, the lineage, to every cached result. Retrieval is then gated by a policy that serves a cache hit only when the requester is authorised for every column that result touched. Access is decided by where the answer came from, not by what it looks like.

The authors prove by construction that, provided lineage recording is complete, the policy blocks retrieval of any result derived from a sensitive column outside the requester's permissions, at linear cost in the worst case. They are explicit about what kind of statement that is: a conditional design guarantee, not an empirical claim. It also has a stated blind spot. It does not cover derived features that encode sensitive information without naming their source. Completeness of lineage matters in practice too. Eliminating measured leakage required between seventy-five and ninety percent recorded lineage completeness, so the authors adopt ninety percent as a conservative deployment target.

Six experiments compare lineage-gated retrieval with naive content-gated memory. The naive version suffers cross-department leakage of between eighteen point eight and twenty-five point five percent. Lineage gating removes it.

Meanwhile it keeps between eighty-one point five and eighty-two point six percent of memory reuse, at a worst-case overhead of thirteen point eight microseconds. A real-agent proof of concept, with SQL generated by a language model, is consistent with the guarantee: zero leaks over nine round-trips, and two conflicts caught automatically. The authors are careful to call this a feasibility demonstration, not evidence that the approach is viable in production.

The framing throughout is modest about its own reach. A proof that holds only if lineage is recorded, a threshold for how complete that recording must be, and a small live demonstration labelled as exactly that. What is offered is a governance layer for shared agent memory, intended to complement access control at the data source rather than replace it, and to support compliance with the EU AI Act.