Memory you can defend in a review.
Accurate answers at a token discount are table stakes — every approach on the architecture page claims some version of them. Governance is what happens after retrieval: the rules that decide which memory is allowed to shape an answer, and the checks that prove those rules hold. Most memory products don't publish governance guarantees. Most don't have them.
Memory is an attack and compliance surface: poisoning (adversarial writes that steer later retrieval), scope leakage, erasure requests, and the audit question every reviewer eventually asks — why did the agent know that? Incumbents defer all of it to your application code. Memomee enforces it at the read path.
Six mechanisms, all enforced — none bolted on.
Behavior-changing memory is gated.
Facts are freely retrievable. But memories that change how an agent acts — procedures, preferences, learned lessons — are born pending: captured, indexed, and inert until explicitly approved. A memory that would change behavior can never slip into context unreviewed. Approval, versioning, rollback, and audit are first-class, per the behavior-changing-memory control requirement (§9.4).
The agent infers 'always deploy on Fridays' from one incident. It sits in the review queue — visible, inspectable — until a human approves it. It never shapes an answer before that.
Facts are replaced, never silently overwritten.
When a fact changes, the new version supersedes the old — and the old one stays, linked, with its validity interval and provenance. 'Use SQLite' superseded by 'Use PostgreSQL' is a transition you can inspect, not an edit you have to trust. Contradiction detection runs on both write and read — across factual, temporal, preference, procedure, decision, scope, and artifact-version classes — and produces explicit, queryable records.
'Deadline Friday' becomes 'Deadline Monday.' Retrieval resolves to Monday; the trace shows Friday was superseded, by what, and when.
On conflict, the system says 'I don't know.'
When memory is missing, conflicting, stale, or out of scope, the governed read path abstains rather than guessing. Explicit uncertainty over unsafe recall — an agent that sometimes declines is cheaper than an agent that confidently acts on a contradiction.
Two approved procedures disagree. Instead of picking one silently, the assembled context flags the conflict and the answer declines — with both procedures cited in the trace.
One user's memory can never surface for another.
Every store takes a workspace identifier on every data method; reads outside the workspace return nothing, and hosted endpoints resolve tenancy from auth — never from the request. Cross-user isolation isn't a policy promise; it's a structural property, re-verified by a zero-tolerance gate on every release.
A support agent with ten thousand customers' memories: customer A's context bundle is assembled from A's scope only — enforced at the query layer, not the prompt layer.
Delete, expire, quarantine, redact — on request.
Forgetting is a feature, not an absence. Memories carry validity intervals and expire; user erasure is a first-class operation — derived memory is deleted with its supersession chain repaired, and the append-only event record is redacted in place (built for GDPR requests); suspect memory can be quarantined without destroying the evidence; secrets can be scrubbed from the record.
An erasure request lands: the user's derived memories are deleted — supersession chains repaired so nothing dangles — raw events are redacted to placeholders, and the audit log records exactly what was removed and when.
Every answer is auditable back to its evidence.
Raw events are append-only — write-once, enforced at the database level — so history is reconstructable. Every retrieval writes a trace: what was considered, what was injected, what was filtered, and why. 'Why did the agent know that?' becomes a query, not an investigation.
A reviewer asks why the agent quoted a superseded policy. The retrieval trace shows the candidate pool, the resolution step that filtered it, and the ranking rationale — no log archaeology.
Re-verified on every release, with zero tolerance.
These aren't third-party benchmarks — they're guarantees, checked by deterministic suites that fail the build on any regression. The right evidence is found wherever a correct answer exists (critical recall 1.00), superseded and expired memory stays out of context, and the checks never depend on a live model, so a green run means the same thing every time.
- Chained-fact retrieval across multiple hops
- Contradictions resolved by trust and recency
- Abstains — says 'I don't know' — instead of guessing on a conflict
- One user's memory never leaks into another's
- Governed forgetting — delete, expire, quarantine, redact on request
- A deterministic baseline, so the checks never depend on a live model
The checklist — ask any memory vendor, us included.
Six questions that separate governance from storage, each with the answer that should make you suspicious.
| Ask | Be suspicious of |
|---|---|
| At which layer is tenant isolation enforced? | "The prompt tells the model to stay in scope" — that's a hope, not an enforcement. Look for the query layer. |
| Can a learned procedure take effect unreviewed? | "The pipeline extracts and stores automatically" — with no approval state between write and read. |
| What exactly happens on an erasure request? | "File a ticket" — look for an operation with an audit record, and ask what happens to the raw event record. |
| When two memories conflict, what does the answer do? | Silently picking one. The governed answer is to resolve by trust and recency — or abstain, and cite both. |
| When a fact changes, what survives? | In-place overwrite. Look for the old value kept, linked, with a validity interval — lineage, not amnesia. |
| Show me why the agent knew that. | Log archaeology. Look for a retrieval trace: what was considered, injected, filtered, and why. |
Storage is solved. Management is not.
Research now treats agent memory as a write–manage–read loop, and the failures that matter live in the management layer: summary drift, stale recall, contradiction handling, retrieval mismatch. Every approach in the landscape stores and searches; almost none decide what should survive, change, be forgotten, or shape the next answer. That decision layer is what a control plane adds — and it's the layer enterprise review boards actually ask about.
Governance is also why Memomee can be honest about the trade-off elsewhere: because the guarantees are enforced structurally, the comparison page can show its accuracy gaps in the open instead of hiding them behind adjectives.