Nine mitigations across three layers: control who can write, validate what gets stored, and limit what retrieved content can influence.
MIT01
Input Validation at Ingestion
Sanitize and filter all content entering the memory store — blocking instruction-like patterns before they're written.
MIT02
Source Provenance & Attribution
Tag every memory entry with its source, author, timestamp, and trust level. Retrieved entries surface this metadata to the agent.
MIT03
Memory Access Controls & Isolation
Enforce strict per-user and per-tenant namespace isolation. No cross-user or cross-tenant retrieval without explicit permission.
MIT04
Memory TTL & Expiration
Every memory entry has a time-to-live. Older entries expire automatically — limiting the persistence window of any poisoned belief.
MIT05
Human Review for High-Stakes Writes
Memory writes that encode policies, authorizations, or behavioral rules require human approval before being stored.
MIT06
Memory Tier Separation
Read-only curated knowledge is separated from writeable episodic memory. Agents cannot write to the curated knowledge tier directly.
MIT07
Reduced Trust for Retrieved Content
Retrieved memory is not treated as ground truth. The agent applies epistemic skepticism and can be prompted to verify high-stakes retrieved claims before acting.
MIT08
Memory Write Audit Logging
All writes to the memory store are logged with full context. Anomalous write patterns — unusual sources, instruction-like content — generate alerts.
MIT09
Periodic Memory Integrity Review
Scheduled review of memory store contents — automated scanning for injected instructions, plus periodic human review of high-trust entries.