Your AI Agents Are Sharing More Than Knowledge

Scope note: This essay treats shared agent memory, organizational process knowledge, contextual access, provenance, contradiction handling, and deletion as one governance problem. It does not establish that any cited memory system is ready for unrestricted enterprise use.

Shared memory sounds like the cure for a badly coordinated group of AI agents.

One agent learns the policy. Another finds the customer history. A third records the exception. The next agent begins with the benefit of all three.

Then the wrong agent retrieves the exception. An old rule survives a new one. A deleted fact remains active. A summary loses the name of the person or system that supplied it. Coordination improves. Control dissolves.

Recent research on multi-agent memory is converging on an unfashionable conclusion: memory is not mainly a storage feature. It is a governance system. If an organization cannot say who may remember what, for how long, from whom, and under which task, it has built a leak with a search box.

Recall is only one requirement

Most agent-memory benchmarks ask whether a system can remember a fact after a long conversation. That matters for a personal assistant. It is incomplete for a workplace.

A shared organizational memory must also answer harder questions:

• Was this person allowed to write the record?
• Is the current agent allowed to read it for this task?
• Has a newer record replaced it?
• Can the answer show where the fact came from?
• Does a deletion request remove the fact from later use?
• Can two valid records disagree without one silently winning?

GateMem, by Zhe Ren and a large research team, turns those questions into a benchmark for workplaces, hospitals, schools, and households. It evaluates useful long-term recall alongside access control and active forgetting. The benchmark matters because a memory can answer correctly and still violate the boundary around the answer.

PiSAs narrows the privacy problem further. Its authors distinguish whether information is relevant to the task from whether a particular user is allowed to receive it. Those are not the same test. A salary record may be exactly relevant to an analysis and still be wrong for the agent to expose.

Production memory fails at the seams

Governed Shared Memory for Multi-Agent LLM Systems offers the strongest production evidence in this group. Yanki Margalit and his coauthors describe four recurring failures: unauthorized leakage, stale information spreading, contradictions persisting, and provenance collapsing.

They implemented controls for scoped retrieval, replacement over time, provenance, and policy-governed propagation in a live multi-tenant service. The evaluation reconstructed complete four-step provenance chains and reported no leakage across separate fleets.

It also found a real defect.

Tenant isolation held, but one direct request route initially bypassed a narrower sub-tenant scope check for agent credentials. The team disclosed and repaired the path. A second conflict appeared between two safety mechanisms: a quick duplicate check could reject a contradictory update before the slower contradiction detector examined it.

That is useful research because the system did not merely perform well. It revealed where reasonable controls fought each other.

Governance fails in the joints.

One organizational memory beats many private rule piles

The alternative to shared memory is not no memory. It is usually several hidden memories.

Each agent receives its own prompt, retrieval index, copied policy, and local collection of exceptions. The same rule appears in several places. Updates arrive at different times. Nobody can tell which agent is using which version.

Organizational Memory for Agentic Business Process Execution, by Lukas Kirchdorfer and his coauthors, argues for a shared, governed reference layer that turns policies, process models, and operating procedures into agent-consumable knowledge. Their paper is an architectural proposal rather than a long-running deployment, but it names the organizational problem precisely: duplicated context becomes duplicated authority.

Context Kubernetes reaches a similar conclusion through infrastructure. Charafeddine Mouzouni proposes declarative rules for delivering the right knowledge to the right agent with the right permissions and freshness. The experiments use synthetic seed data, so the work does not prove production reliability. Its strict rule is still worth carrying forward: an agent’s authority should remain a subset of the human authority under which it acts.

The agent does not become entitled to a record merely because the record exists.

Provenance must survive summarization

Enterprise AI systems compress. They summarize long records, merge several sources, and store the result for later use. Compression keeps the memory affordable. It can also remove the evidence that made the record trustworthy.

If a stored summary says that a process requires approval, the next agent needs more than the sentence. It needs the source, date, author or system, applicable role, superseding record, and transformation history. Otherwise the memory can preserve the claim while losing its authority.

This is why provenance cannot be a citation added at the end. It must be part of the record’s structure. Every derived statement needs a route back through the statements and sources that produced it.

The paper on governed shared memory demonstrates why. Its production system could reconstruct a four-step derivation chain. That is not decorative transparency. It is how an organization finds the joint that failed.

Forgetting is an active operation

Knowledge-management programs tend to treat deletion as loss. Shared AI memory makes forgetting a control.

A record may be withdrawn because a person requested deletion, a policy expired, a contract ended, a fact was corrected, or the original collection was never authorized. Removing the visible record is insufficient if a summary, cache, embedding, or derived memory still supplies the old fact.

GateMem calls this active forgetting. The phrase is exact. Deletion must change what the agent can retrieve and use, not merely what an administrator can see.

That requirement becomes harder when memory moves across several agents. A propagation system must carry both knowledge and the later instruction to stop knowing it.

Build the boundary before the memory

My practical conclusion is simple. Before an organization shares memory across agents, it should define six operations:

1. Scope: which user, role, agent, and task may retrieve the record.
2. Provenance: who or what created it, and which sources support it.
3. Time: when it became valid and when it should be reviewed.
4. Supersession: which newer record replaces it without erasing history.
5. Contradiction: how competing records remain visible until a real authority resolves them.
6. Forgetting: how deletion propagates through copies, caches, summaries, and derived records.

These are knowledge-management functions. The agent architecture merely makes their absence louder.

Shared memory can make a group of agents more capable. It can also let every local mistake travel farther. The difference is not model intelligence. The difference is whether the organization designed memory as authority, or mistook it for a larger notebook.