Map the corpus
Every source feeding retrieval or memory, and the trust level each one actually warrants.
Warden · Agentic Assurance
An agent's memory is a database that accepts writes from strangers
An audit of what your agents remember, retrieve and treat as trusted — and whether a single poisoned document can shape decisions long after it was ingested.
Retrieval turns yesterday's content into today's instruction
Vector stores and long-lived agent memory are usually populated from sources with mixed trust, then read back without any record of where a given claim originated.
- Ingestion is rarely authenticatedContent is indexed because it was reachable, not because it was vetted.
- Provenance is dropped at retrievalThe chunk that reaches the model usually arrives without its origin, so the agent cannot weigh it.
- Poisoning persistsUnlike a prompt injection, a poisoned memory keeps influencing behavior across sessions and users.
How the audit runs
Trace provenance
Follow a sample of retrieved content back to origin and record where the lineage breaks.
Test with seeded content
Introduce marked benign content into the ingestion path and observe whether and how it later influences output.
Recommend controls
Source segregation, provenance retention at retrieval, and detection for the paths that cannot be closed.
What you hold at the end
- A source map of everything feeding memory and retrieval, with trust classification
- Findings on where provenance is lost between ingestion and generation
- Seeded-content results showing which ingestion paths reach production answers
- A control plan covering segregation, provenance retention and detection
Related products
Mimir is the research line behind this work. It is in preview and not generally available, so the engagement delivers the audit and the controls, not a Mimir deployment.
Know where the answer came from
An agent that cannot tell you the origin of a claim cannot be governed on the strength of that claim.