Short answer
Agent Zero Memory (arXiv:2608.29606) is a provenance-aware long-term memory architecture for LLM agents. It maintains three linked memory forms - an episodic timeline of events, an entity-event knowledge graph, and a hierarchical documentary memory of layered summaries - and routes retrieval across them using intent gating and source routing, with concurrent retrieval over all three.
Every remembered claim carries provenance: where it came from, when it was recorded, and a pointer to the supporting evidence. The core discipline Ernesta Labs adopted is the citation lock: a retrieved claim does not become usable merely because a summary asserts it. For consequential claims - permissions, money, irreversible actions - the runtime opens the supporting evidence and retains it alongside the claim.
Provenance is not truth. A cited source can be wrong, poisoned, stale, or misidentified. Provenance makes memory auditable and traceable; it does not make memory correct. That caveat is part of the adoption, not a footnote to it.
The failure mode: memory that keeps the conclusion and loses the receipt
Most agent memory systems remember conclusions. A long run produces thousands of observations, the system compresses them into summaries and extracted facts, and later runs retrieve those compressed artifacts as if they were the original events. The receipt is gone. What remains is an assertion with the confidence of a database behind it.
The failure is quiet and compounding. At time T0 an agent observes something ambiguous - a user types a sentence in a chat, a tool returns a partial result - and writes a memory: the user approved the upgrade. The observation was ambiguous, the extraction was lossy, or the agent simply inferred past its evidence. At time T1, weeks later, another run retrieves that memory. It is structured, it is old, and it came from the memory store, so it carries the epistemic weight of a record. The agent acts on it. Nobody can later answer the only question that matters: what did the user actually say, and where is it?
This is how agent-generated memory launders inference into fact. The first writer guessed. Every subsequent reader treats the guess as ground truth, because the memory system has no mechanism for distinguishing a recorded observation from a summarized inference from an outright hallucination. The Memory Trust Gap work (arXiv:2609.01852) documents the downstream shape of this problem: persistent-memory agents fail in ways that depend on model capability, and weaker models trust their own memory more than the evidence warrants. The gap between what memory says and what memory can support is a capability-dependent failure surface, not an edge case.
What the paper actually does
PRIMARY SOURCE RESULT: Agent Zero Memory (arXiv:2608.29606, 'Agent Zero Memory: Provenance-Aware Long-Term Memory for LLM Agents') proposes a long-term memory architecture in which provenance is a first-class property of every stored item. Memories are not free-floating text; each carries an origin, a timestamp, and pointers to the evidence that supports it, so that any retrieved claim can be traced back to the event or document it was derived from.
PRIMARY SOURCE RESULT: The architecture organizes memory into three linked forms: an episodic timeline that records what happened in order, an entity-event knowledge graph that records relations between actors and objects, and a hierarchical documentary memory that maintains layered summaries at increasing levels of abstraction. Retrieval is mediated by intent gating and source routing - queries are filtered by the current task intent and routed to the memory forms that can answer them - with concurrent retrieval running across the forms and results merged for the current decision.
PRIMARY SOURCE RESULT: We deliberately do not quote performance numbers from the paper. Its evaluation demonstrates that the architecture works as specified on the studied tasks; it does not, at paper scale, establish that this design is the right memory architecture for every agent, nor does it test adversarial corruption of the provenance metadata itself. Those are separate claims, and we treat them as open.
Three memory forms, one provenance spine
The three forms are not redundant; they answer different questions and fail differently. The episodic timeline answers what happened and when. It is append-only and ordered, which makes it the closest thing the system has to an audit log: you can replay what the agent actually observed, in sequence. Its weakness is that raw timelines are long and expensive to read, which is why agents rarely consult them directly.
The entity-event knowledge graph answers who and what: which actors, which objects, which relations, extracted from the timeline. It is fast to query and naturally supports multi-hop questions. Its weakness is that extraction is a lossy, model-driven process - a fact in the graph is already one inference away from the evidence, and graph structures look authoritative even when the extraction was wrong.
The hierarchical documentary memory answers what it all means: rolling summaries, compressions of compressions, designed to give a working agent an affordable view of its own history. This is the form agents read most, and it is also the form furthest from the evidence. Each layer of summarization is another opportunity to sharpen an ambiguity into a false certainty.
LABS INTERPRETATION: The value of the architecture is not any single form but the spine that connects them. Because every item in every form carries origin, timestamp and evidence pointers, the compressed forms become indexes into the evidentiary forms rather than replacements for them. A summary can still be wrong - but when it matters, you are one pointer away from the thing it summarizes. Memory becomes navigable instead of merely retrievable.
Intent gating and source routing: retrieval that knows what it is for
PRIMARY SOURCE RESULT: The paper's retrieval layer gates retrieval by intent and routes queries by source. Intent gating means retrieval is filtered by what the current task is trying to establish - a question about consent should not pull in an unrelated episode because it shares keywords. Source routing means the query is directed to the memory forms that can actually answer it, rather than always searching the same index. Concurrent retrieval runs these lookups across forms in parallel and merges the results.
This matters more than it sounds. A single-vector memory store forces every question through one retrieval surface, which means a knowledge-graph fact, an episodic memory, and a summarized conclusion all compete in the same ranking. When the task needs episodic proof - did the user actually say this - a confident graph assertion can outrank the humble timeline entry that contradicts it. Routing by intent is a coarse but effective way to keep the wrong kind of memory from answering the wrong kind of question.
It is not a guarantee. Intent classification is itself a model prediction, and a misclassified intent silently selects the wrong retrieval surface. Treat routing as a precision tool with its own failure mode, and log which form answered which question, so failures are attributable after the fact.
The citation lock: evidence must be opened, not merely referenced
Here is the discipline Ernesta Labs took from this paper, sharpened into a rule we can enforce in a runtime. A retrieved memory claim should not become usable merely because a summary says so. Pointers alone are not enough - a pointer that is never followed is decoration. For consequential claims - anything touching permission, money, irreversible effects, or statements the system will make as fact - the runtime must open the supporting evidence and retain it alongside the claim. The claim and its opened evidence travel together into the decision. If the evidence cannot be opened, the claim is downgraded to hearsay and the action that depended on it does not run.
LABS INTERPRETATION: This converts memory from an oracle into a lead. The summary says the user consented; the citation lock forces the system to fetch the actual consent record before acting on the word of a compression layer. Most of the time the evidence agrees and the lock costs one lookup. The times it disagrees are exactly the times the lock exists for: the stale claim, the misextracted relation, the summary that flattened a conditional into an absolute.
LABS RECOMMENDATION: Implement the pair of PROVENANCE LOCK and CITATION LOCK. Provenance lock: no memory item is written without origin, timestamp and an evidence pointer, and those fields are written by the runtime, not composed by the model. Citation lock: for a defined class of consequential actions, the supporting evidence is opened at use time and attached to the decision record. Both are auditable, both are cheap relative to the failure they prevent, and both fail closed - an unauditable memory is an unusable memory, which is the correct default.
Limitations
Provenance does not solve truth. A properly cited source can still be wrong, poisoned, stale, or misidentified. A memory can point faithfully at evidence that was itself a hallucination, a manipulated document, or a record that has since been superseded. Following the pointer improves your epistemic position; it does not guarantee the destination. Anyone selling provenance as truth is selling the wrong product, and we want that stated plainly in our own adoption.
The provenance metadata is itself a writable surface. If the same agent pipeline that writes memories also writes their origin and evidence pointers, the metadata inherits the pipeline's failures - and an adversarial writer can forge plausible provenance. This connects directly to the memory poisoning literature (see our article on PipePoison and endogenous authorization laundering): provenance structures make forgeries more convincing, not less, unless the metadata is written by a mechanism the memory writer cannot control.
Opening evidence costs latency and context. The citation lock is affordable precisely because it applies only to a defined consequential class; applying it to every retrieved claim would consume the context budget that the hierarchical summaries exist to protect. The paper's evaluation scale also bounds what it demonstrates: the architecture works as designed on the studied tasks. Production behavior under adversarial writers, cross-model drift, and years of accumulated memory is unproven, and we treat it as such.
Why builders care, what we would implement, and what we would not
Why builders care: every long-horizon agent becomes a memory system with a chat interface attached. The memories are the product's knowledge of your users, your counterparties, your own history. If those memories are unauditable, the system accumulates confident, untraceable claims about the world - and the longer it runs, the more of its behavior is justified by receipts nobody kept. Provenance is the difference between a system you can debug and a system you can only restart.
LABS RECOMMENDATION: What we implement is the spine, not the whole organism. We adopt: mandatory runtime-written provenance on every memory item; episodic evidence retained as the ground layer; summaries treated strictly as indexes with pointers; citation lock on the consequential action class; and routing logs that record which memory form answered which question. These pieces compose into any existing stack - you can bolt them onto a vector store without adopting a new memory framework.
What we would not implement: we would not adopt a full hierarchical documentary memory with many summarization layers at our scale. Every layer is an inference step away from evidence and a maintenance liability; two levels - evidence and one working summary - are enough for us, and the citation lock keeps the summary honest. We would not make the knowledge graph the canonical store: graphs are excellent lookup structures and terrible ground truth, because extraction errors become structural. And we would not let the model compose provenance fields - the moment the same process that guesses the memory also writes its receipts, the receipts stop meaning anything.
CASE STUDY - NIKO: receipts on every subscriber claim
NIKO accumulates claims about waitlist subscribers: what they asked for, what they consented to, what they were told. Under the adopted pattern, no such claim lives in memory as bare text. Each carries a runtime-written origin, a timestamp, and a pointer to the originating record - the form submission, the confirmation event, the diary-verified persistence entry. The summaries the agent reads are indexes into those records, never replacements for them.
The citation lock applies to the consequential class: outbound email. Before any send decision uses a remembered fact about a subscriber, the runtime opens the pointed-to record and attaches it to the decision. If the memory says consented and the opened record does not support that, the send does not run. This matters because NIKO's own diary records what happens when recorded claims and reality diverge - a form that recorded success while persisting nothing is precisely the unauditable-memory failure this pattern exists to catch.
DESIGNED: provenance-locked subscriber memory with citation lock on send decisions. IMPLEMENTED: runtime-written origin, timestamp and evidence pointers on memory items; evidence opened and retained for consequential actions. TESTING: behavior on a growing real subscriber base as memories accumulate. VERIFIED: the mechanics - that every consequential decision carries opened evidence retrievable from the decision record. NOT YET PROVEN: that the lock has caught a real would-be mis-send in production; no such incident has occurred to exercise it. The pattern is adopted on principle and verified mechanically, not yet vindicated by an interception.
Practical test: can you open your agent's memories?
Run this against your own system today. Pull the ten memories your agent retrieves most often - from the vector store, the graph, the summary cache, wherever they live. For each one, answer one question: where did this come from, and can you open the original? Not a re-embedding, not another summary - the originating record, event, or document. Score each memory as openable, pointer-only, or orphaned.
Most systems we have seen fail this immediately: the majority of high-traffic memories are orphaned assertions. The fix is incremental. First, stop the bleeding: modify the memory write path so every new item records origin, timestamp and an evidence pointer, written by the runtime rather than the model. Second, quarantine the orphans: mark existing unauditable memories as low-trust so consequential actions cannot rely on them. Third, add the lock: pick your one most consequential action and require its supporting evidence to be opened and attached before execution. An afternoon of work for the first step, a day for all three - and you will learn exactly how much of your agent's knowledge of the world is currently receipts-free. The answer is usually uncomfortable.
What remains unknown
- How provenance metadata behaves under adversarial pressure - a memory writer that can forge plausible origin and evidence pointers defeats the lock, and we have not tested our runtime's resistance to that class of attack.
- The long-run cost curve: as evidence accumulates for months or years, retention, compaction and pointer integrity all degrade, and no study cited here establishes how the architecture behaves at multi-year scale.
- Whether intent-gated source routing holds up under ambiguous tasks, where intent classification itself is uncertain and the wrong retrieval surface gets selected without any observable error.
- The residual gap between opened evidence and truth - cited records can be stale, poisoned or misidentified, and we do not yet have a measured bound on how often our own opened evidence disagrees with reality.