The most direct defense against cross-user memory leakage (Type 6) and multi-agent contamination (Type 5) is strict namespace isolation in the memory store — enforced at the data layer, not just the application layer.

True namespace isolation: Each user, session, or tenant should have a dedicated namespace in the vector store. Retrieval queries are scoped to the namespace at the database level — the filter cannot be bypassed by application-layer prompt injection because the query never touches other namespaces.

Write permission controls: Specify explicitly which identities can write to which namespaces. An agent processing inbound email should only be able to write to a designated "inbound-derived" namespace — not to the curated knowledge namespace or another user's preference store. Write permissions should be as restrictive as read permissions.

Multi-agent memory boundaries: In multi-agent pipelines, shared memory should be structured as a message-passing store with explicit write attribution — not as a common-pool store where any agent can write anywhere. Agents should be able to read from shared memory but write only to their own designated output namespace.

Poisoned memories persist until they are explicitly removed. If memory entries never expire, a successful poisoning event has an unlimited persistence window. TTL policies limit this window automatically.

Tier-specific TTL: In-context memory is ephemeral by definition. Session episodic memory might persist for weeks to months. Long-term preference entries should have the longest TTL but still expire and require re-confirmation — not persist forever. Curated knowledge base entries should have explicit version dates and be replaced on update, not indefinitely accumulated.

Confirmation-required renewal: High-trust entries (behavioral rules, authorizations, policies) should require an explicit human confirmation action to renew their TTL — not auto-renew. If no human confirms the entry is still valid, it expires and must be re-established through a validated channel.