Persistent memory is the next infrastructure layer for enterprise AI. Stateless agents that begin each session without context cannot accumulate organizational knowledge, cannot maintain continuity across multi-day tasks, and cannot learn from prior interactions. The category of AI memory systems, represented by architectures including MemGPT [1], retrieval-augmented generation pipelines [2], and generative agent memory streams [3], has demonstrated that persistent memory materially improves agent capability. Enterprise deployments of these capabilities are growing.

The governance layer that every other enterprise data system requires before responsible operation at scale does not yet exist for AI memory. Database systems have access control, audit logging, and backup governance. Identity systems have least-privilege, provenance, and lifecycle management. Document management systems have version history, retention policy, and erasure workflows. AI memory systems, as currently deployed, have none of these properties formalized.

The gap has three structural dimensions. First, memory accumulates silently: stored artifacts may reflect organizational state from weeks or months prior, yet agents retrieve and act on them as if they were current. The consequences of this silent divergence are not detected by standard retrieval quality metrics, because such metrics measure match quality against stored content, not against current ground truth. We formalize this as Memory Drift. Second, any agent with memory access can retrieve any stored artifact regardless of the artifact's sensitivity, the agent's current task context, or the authenticated principal who initiated the session. We formalize the missing governance primitive as Recall Boundary. Third, when a stored memory artifact must be deleted, whether for regulatory compliance, factual correction, or access revocation, there is no record of how it was created, what it was derived from, or which other artifacts contain its content. We formalize the missing audit primitive as Memory Provenance Chain.

This paper makes the following contributions:

• The Enterprise Memory Governance Framework (EMGF) is introduced as the governance layer governing memory lifecycle, access, drift, provenance, and erasure in enterprise AI persistent memory systems.
• Memory Drift is formally defined as D(M,t), the fraction of stored artifacts that have diverged from source ground truth at time t, with Observation 1 establishing that memory becomes net harmful above a critical drift threshold.
• Recall Boundary is formally defined as the function B: A × P × C × T → 2^M mapping agent-principal-context-time tuples to permitted memory subsets, providing the first formal access control primitive for AI memory retrieval.
• Memory Provenance Chain is formally defined as the transformation sequence Π(m) from source ingestion to current state, providing the technical foundation for GDPR Article 17 compliance and drift-source diagnosis.

MemGPT introduced an operating-system-inspired memory hierarchy for large language models, separating in-context working memory from external persistent storage and providing explicit mechanisms for paging content between the two tiers [1]. Generative Agents demonstrated that agents equipped with memory streams and reflection mechanisms, which retrieve and summarize prior observations, can exhibit coherent long-horizon behavior across simulated environments [3]. Retrieval-Augmented Generation established the retrieval primitive that most enterprise memory architectures build on: relevant stored context is retrieved and inserted into the agent's context window at inference time [2].

The "lost in the middle" finding demonstrates that position within the context window affects retrieval quality independent of semantic relevance, with content in the middle of long contexts being reliably underweighted by models [4]. Long-context architectures such as Longformer [8] extend the in-context memory available to a single inference but do not address the lifecycle, access control, or provenance concerns that arise when memory persists across sessions and principals.

No existing framework addresses the three structural deficits this paper targets. The NIST Privacy Framework v1.0 [7] provides risk management principles for privacy-affecting systems but does not define memory-specific constructs for AI systems. ISO/IEC 27001:2022 [6] provides information security management principles covering access control and audit logging but does not address AI memory lifecycle or drift. GDPR Article 17 [5] creates the right-to-erasure obligation but provides no technical framework for fulfilling it against an AI memory store that lacks provenance tracking. The EMGF is designed to fill all three gaps with formally defined, operationalizable constructs.

The EMGF is the third governance layer in a three-layer enterprise AI governance stack. The EACP [10] governs individual inference requests: what models receive, at what cost, under what access policy. The EAGF [9] governs what individual agents do with model outputs: what actions they take, subject to blast radius bounds and reversibility constraints. The EMGF governs the memory substrate those agents draw on: what is stored, how it ages, who can retrieve it, and how it is deleted. All three layers are necessary; none is sufficient alone.

Let M be a memory store containing artifacts {m₁, m₂, ..., m_n}. For each artifact m_i, let s(m_i) denote its source and t_i denote its ingestion timestamp. Let R(t) denote the ground truth reference state of the organization at time t.

Memory Drift is not bounded by retrieval quality metrics: a memory store can simultaneously exhibit high retrieval precision against stored content and high Memory Drift against current ground truth, because precision measures match quality against what is stored, not against what is currently true. This distinction is the source of the Stale Memory Amplification Property.

This has a direct organizational consequence: an enterprise that deploys persistent memory without drift monitoring may find that its memory infrastructure is actively degrading agent performance while appearing to function correctly by standard retrieval metrics. The threshold θ is system-specific and domain-specific; organizations must define and calibrate it as part of EMGF deployment.

Let A be the set of agents, P the set of principals (users, roles, or services), C the set of task contexts (including classification levels and business unit scope), T the set of time points, and M the full memory store.

Recall Boundary is the memory-system analogue of role-based access control for data stores, but with the context dimension C added. Context is essential: the same agent operating under the same principal may be permitted to retrieve personnel records in an HR workflow context but not in a customer-facing context. Without the context dimension, Recall Boundary reduces to coarse-grained role control and cannot govern the task-specific retrieval scope that enterprise deployments require.

Memory Provenance Chain enables three capabilities that cannot be implemented without it. First, GDPR Article 17 [5] erasure compliance: deleting a subject's data requires locating all artifacts derived from it, which requires traversing the provenance chain from every ingestion point. Second, drift diagnosis: the ingestion timestamp in Π(m) determines the artifact's age relative to ground truth updates, making per-artifact drift computation possible. Third, incident investigation: any agent behavior traceable to a retrieved memory artifact can be traced back to the original source, operation sequence, and ingestion principal.

The EMGF operationalizes the three formal constructs from Section III into a five-component architecture. Each component is independently deployable, allowing incremental adoption across the four maturity tiers defined in Section VI. The EMGF operates on a principle that distinguishes persistent memory governance from stateless inference governance: memory compounds. An ungoverned decision at ingestion time, what to store, from whom, with what scope, propagates to every future retrieval that depends on that artifact. Governance must therefore be applied at write time, not only at read time.

The five EMGF components are: the Memory Provenance Tracker, which attaches a Π(m) chain to every memory write; the Recall Boundary Enforcer, which applies B(A,P,C,t) to every retrieval request; the Memory Drift Monitor, which computes D(M,t) continuously and triggers escalation when drift crosses the configured threshold θ; the Cross-Session Memory Auditor, which maintains an immutable log of all memory operations; and the Memory Expiration Orchestrator, which manages the full artifact lifecycle including drift-triggered expiration and GDPR Article 17 erasure cascade. Fig. 1 presents the reference architecture. Table I presents the failure mode analysis for each component.

The Memory Provenance Tracker intercepts every memory write operation and constructs the initial tuple (s₁, o₁, t₁) where o₁ = ingest, s₁ is the originating source, and t₁ is the write timestamp. Subsequent operations that transform the artifact append additional tuples to Π(m). The Tracker must be positioned as a write-path interceptor, not a post-hoc logger. Retroactive provenance reconstruction from a memory store that was ingested without tracking is not reliably achievable and does not satisfy GDPR Article 17 erasure obligations, which require the ability to locate all derived artifacts [5].

The Recall Boundary Enforcer evaluates B(A, P, C, t) at every query and filters the retrieval candidate set to the permitted subset before ranking or insertion into the agent context window. The context dimension C is the most operationally complex input. Organizations must define a finite context taxonomy as part of EMGF deployment, because a context that is not enumerated defaults to the most permissive boundary, which is equivalent to no enforcement. The EAGF Delegation Boundary construct [9] provides a complementary primitive for the action scope that follows a recall operation; together they cover both the retrieval and action surfaces of agent governance.

The Memory Drift Monitor computes D(M,t) continuously against a configurable reference baseline. For document-backed stores, the reference is the source document version at ingestion; the monitor detects when source documents are updated and flags dependent artifacts. For conversation-backed stores, the monitor applies a time-to-stale threshold beyond which artifacts are flagged as presumptively drifted. Organizations must define their drift threshold θ as an explicit configuration parameter; θ is domain-specific. A legal compliance memory store may require θ < 0.05, while a general knowledge store may tolerate θ = 0.20. Without an explicit θ, the Stale Memory Amplification Property cannot be operationally detected.

The Cross-Session Memory Auditor maintains an immutable log of all memory operations keyed by artifact ID, separate from the memory store itself, so that deletion of an artifact does not delete its audit history. The audit log is the primary investigation surface for three scenarios: compliance investigation (which agent retrieved which artifact, in which context, at what time); erasure verification (confirming that an Article 17 deletion has propagated to all derived artifacts); and drift incident analysis (tracing a degraded agent response back to the stale artifact that caused it).

The Memory Expiration Orchestrator manages the complete artifact lifecycle: scheduled expiration, drift-triggered expiration, erasure-request fulfillment, and archive. It consumes signals from the Memory Drift Monitor (θ breach triggers) and from external erasure requests and uses Π(m) to locate all derived artifacts that must be co-deleted. Erasure must traverse the full provenance chain: if artifact m₁ was summarized into m₂, and m₂ was merged into m₃, an erasure request for m₁'s content must cascade to m₂ and m₃. Without Memory Provenance Chain, this cascade is structurally impossible to implement correctly [5].

Criteria: No persistent memory across sessions. Each agent session begins without prior context. No memory store exists. This tier carries low memory governance risk but also a low capability ceiling. Agents cannot accumulate organizational knowledge. Any deployment of cross-session memory capability should target Tier 2 immediately; remaining at Tier 1 while adding unstructured memory creates all five failure modes simultaneously.

Criteria: Memory Provenance Tracker deployed on all write paths. Basic Recall Boundary enforced at the agent-role level without context dimension. Memory Drift Monitor deployed with alert threshold θ. Manual erasure procedures documented. Indicative deployment timeline: approximately 60 days for organizations with existing identity infrastructure. Provenance Tracker and basic Recall Boundary are the priority; Drift Monitor follows. This tier provides a complete provenance chain from deployment forward, enabling compliant erasure, and establishes the baseline for Tier 3.

Criteria: Full Recall Boundary with context dimension C defined and enforced. Memory Drift Monitor operating with automated expiration triggers at configured θ. Cross-Session Memory Auditor generating structured audit logs. Memory Expiration Orchestrator handling erasure requests with provenance cascade. Indicative timeline: approximately 90 days from Tier 2, dependent on context taxonomy definition. At this tier, Recall Boundary violations are detectable, drift incidents are traceable, and erasure requests are fulfillable within defined SLAs.

Criteria: All five EMGF components operational. Drift threshold θ calibrated per memory domain. Recall Boundary coverage verified against agent inventory. Provenance chain completeness audited continuously. Memory governance integrated with enterprise identity, DLP, and audit systems. Indicative timeline: approximately 120 days from Tier 2 for organizations with mature identity and audit infrastructure. At this tier, GDPR Article 17 obligations are structurally fulfillable, ISO/IEC 27001:2022 controls A.5.15 and A.8.15 are addressed, and the NIST Privacy Framework v1.0 Identify-P and Control-P function clusters are operationalized [6][7].

MemGPT [1] and comparable architectures define memory hierarchies and retrieval primitives optimized for capability: getting the right content into the agent's context at the right time. The EMGF is not a retrieval optimization; it is a governance layer that operates on top of any retrieval architecture. The Memory Drift Monitor does not change how retrieval ranks candidates; it flags the memory store state that makes retrieval harmful. The Recall Boundary Enforcer does not change retrieval similarity computation; it filters the candidate set before retrieval operates. The EMGF is compatible with any underlying retrieval architecture.

The "lost in the middle" finding [4] establishes that position in the context window affects utilization of retrieved content; this creates an interaction with the Recall Boundary that organizations must account for in context assembly: filtering the candidate set to the permitted subset changes the positional distribution of retrieved content, which may affect how retrieved content is utilized by the model. EMGF-governed retrieval pipelines should evaluate this interaction in their context assembly design.

The EMGF, EAGF [9], and EACP [10] form a complete three-layer enterprise AI governance stack. An organization with a mature EACP and EAGF can simultaneously have no EMGF controls: the EACP governs what goes into each model invocation; the EAGF governs what actions agents take; neither governs the memory substrate those agents draw on. The recommended implementation sequence is EACP first, EAGF second, EMGF concurrent with or immediately following EAGF for any deployment that introduces persistent memory.

The formal definition of Memory Drift assumes access to a ground truth reference R(t). For document-backed stores, this reference is the current document version. For conversational or inferred-state stores, defining R(t) is non-trivial and requires organizational definition of what constitutes authoritative ground truth. The EMGF does not prescribe a ground truth source; organizations must define this as part of Tier 2 deployment planning. The Stale Memory Amplification threshold θ is stated as an existence result; empirical calibration of θ for specific retrieval architectures and domains is a direction for future work.

Persistent AI memory is transitioning from a research capability to enterprise infrastructure, and it is doing so without the governance layer that every comparable enterprise data system has required. The three constructs introduced in this paper address the structural deficits directly. Memory Drift names the silent quality degradation that every enterprise memory deployment is experiencing but cannot currently measure; formalizing it as D(M,t) makes it monitorable and actionable. Recall Boundary names the access control gap that every security team will eventually discover; formalizing it as B: A × P × C × T → 2^M makes it enforceable before an incident surfaces it. Memory Provenance Chain names the audit and erasure prerequisite that GDPR Article 17 already requires but that no current enterprise memory deployment satisfies; formalizing it as Π(m) makes compliance achievable rather than theoretical.

The Stale Memory Amplification Property is the most operationally urgent finding of this paper: it establishes that memory, without drift governance, does not merely become less helpful over time. It becomes actively harmful, degrading agent responses below what the agent would produce without any memory at all. Every enterprise that has deployed persistent AI memory without a Memory Drift Monitor is operating above this threshold without knowing it. The EMGF provides the framework to detect that threshold, govern against it, and build the provenance infrastructure that makes both compliance and diagnosis possible when it is crossed.

© 2026 Arjun Jaggi and Aditya Karnam Gururaj Rao. Open reference model, free to use with attribution. arjunjaggi.com/papers/enterprise-memory-governance.html