Authorization-aware memory for AI agents
Collaborate on MNPI, financial data, deal terms, source code, customer PII, privileged material, board materials with AI and coworkers, safely.
ArtifactAuth makes agentic conversations safe to reuse across your company. Every message carries the authorization of the data it came from, so people only ever search for and see what they have permissions to access.
The problem
You can't trust an AI to keep a secret that's in its context
One clever prompt and the model paraphrases the protected thing right back out. Output filtering and 'don't reveal' instructions are defeated by a single jailbreak, paraphrase, or prompt injection. The only dependable defense is to keep the content out of the model's sight entirely.
Redaction is not a security control
Load protected content, then ask the model to withhold it. Depends on the model staying quiet. Fails on the first jailbreak.
Admission control: secure by construction
Content a reader isn’t cleared for never enters the context whose output they receive. Nothing to leak, no reliance on the model.
How it works
Four everyday rules
The formal model reduces to four things you already understand.
Stamp everything an agent reads
Every artifact an agent pulls in through a tool (a doc, an API response, a database row) is recorded with the authorization it required, as reported by the source system.
Writes inherit their inputs' stamps
When the agent produces a message from protected inputs, that output is labeled at least as strictly as everything that influenced it. A summary of secrets is just as protected as the secrets.
Check authorization at read time
Access is evaluated against a principal's capabilities right now, by your own policy engine. Lose a clearance tomorrow and the same conversation shows you less.
Protected means never shown
Content a reader isn't cleared for never enters the model's context in the first place, so there's nothing for a jailbreak or prompt injection to leak.
The guarantee
Change one thing (the clearance) and the reuse can't happen
Same flow as above. This time Person B isn’t cleared for the tool that produced the answer, so the agent’s search() of shared memory comes back empty. There’s nothing to withhold, and nothing to leak.
Person B lacks the tool's clearance, so the search returns nothing, by construction.
Two verbs
record() what an agent read. assemble() only what a reader may see.
That's the whole integration surface. Point us at your policy engine and go.
curl -X POST https://api.artifactauth.com/v1/conversations/c1/segments \
-H 'authorization: Bearer aaa_sk_...' \
-H 'x-aaa-principal-id: alice' \
-H 'content-type: application/json' \
-d '{
"role": "tool_result",
"content": "Q3 booked sales were ...",
"receipts": [{ "resource_id": "sales-q3",
"requirement": { "cap": "cap://acme/booked-sales" } }]
}'Why ArtifactAuth
Built for the part that's hard to get right
Admission control, not redaction
Telling a model 'don't reveal this' is not a security control. One paraphrase defeats it. ArtifactAuth keeps unauthorized content out of the context entirely, so the guarantee holds by construction.
Bring your own authorization
Your policy engine stays the source of truth. Plug in Cedar, OPA, IAM, Okta/Entra, LDAP or SCIM through one small Policy Decision Point interface, queried live per read or fed a grant snapshot you push. Works for RBAC and ABAC.
Gated search & cross-user reuse
A later, differently-cleared user can mine what the agent already learned for others, and similarity search and cross-conversation retrieval return only the segments they're individually cleared for.
Live revocation
Requirements are persisted, not decisions. Capabilities are re-evaluated on every read, with push-invalidation for near-immediate revocation.
Harness-agnostic
An open specification any agent framework can conform to by reading the envelope and implementing the PDP interface. Reference ports exist for the Vercel AI SDK, Koog and Google ADK.
Audit by construction
Every permit, deny, and declassification lands in an immutable, hash-chained ledger: the compliance evidence regulated buyers ask for.
- 2 verbs
- record + assemble is the whole integration
- 5 levels
- public → top secret, your capabilities underneath
- p99 < 250ms
- target latency for gated context assembly
- 3 harnesses
- reference ports: Vercel AI SDK, Koog, Google ADK
Make your agent's memory safe to reuse
Create an organization, connect your policy engine, and mint your first key in minutes.