Safer Agent Memory Standard (SAMS)

Security-first memory for AI agents. Scoped memory tiers, taint tracking, tenant isolation and human-reviewed consolidation, as a short standard, a zero-dependency Python reference implementation, a conformance test suite and a Claude Code plugin that applies it to your project.

Your agent's memory is a persistence mechanism for prompt injection. One poisoned web page, scan result or email, written to memory, is read by every future session. SAMS is a set of rules and tests that stops that from happening.

Why

Most agent memory projects focus on recall: how to store and find the right memory. SAMS focuses on governance:

• Scopes. org, project, tenant, run. Agents write freely only to their own run scratchpad.
• Taint. Sessions that read outsider-controlled content are marked by the harness, not the agent. Their writes never reach curated memory unreviewed.
• Tenant isolation. One customer's data never reaches another's memory, or shared memory.
• Dreaming. A scheduled job reviews many sessions and proposes changes (redacted, flagged, with evidence). A human accepts or rejects each one.
• Guardrails. Versioning with provenance, optimistic locking, permissions enforced below the agent.

It builds on the context-engineering practices Anthropic has described publicly (memory as files, progressive disclosure, out-of-band consolidation) and adds the security controls needed when agents handle untrusted input and multiple tenants. SAMS is vendor-neutral and works with any model or agent framework.

What's in the repo

Quick start

Let your coding agent apply it

Install as a Claude Code plugin (or copy skills/adopt-memory and STANDARD.md into your repo), then in your project:

/adopt-memory

The skill inspects the project, writes docs/memory-profile.md, asks you the decisions it must not make alone (tenant unit, taint sources, retention), then builds the right tier and proves it with the conformance tests.

Not using Claude Code? Give STANDARD.md to any coding agent and ask it to follow section 0.

Use the library

pip install safer-agent-memory           # import sams; CLI: sams

from sams import SQLiteBackend, AgentSession, DreamerSession, Owner

backend = SQLiteBackend("memory", read_only=["org"])
session = AgentSession(backend, session_id="s-001", agent="recon-agent", assigned="tenant:acme")

# Taint sources are wrapped by the harness; calling them marks the session.
fetch = session.tainting(my_http_fetch, reason="web_fetch")

# Give the model only these four tools.
tools, schemas = session.tools(), session.tool_schemas()

# Session start: memory as labelled data, not instructions.
context = session.context_block()

Agent writes to run:s-001 land immediately. Writes to tenant:acme are queued as pending (redacted, flagged and versioned, so what you accept is exactly what you reviewed). Writes to org or another tenant are refused.

python templates/dreaming/dream.py --base memory --scope tenant:acme --transcripts logs/acme
sams review list   --base memory --scope tenant:acme
sams review show   --base memory --scope tenant:acme 3
sams review accept --base memory --scope tenant:acme 3
sams pending list  --base memory --scope tenant:acme
sams pending show  --base memory --scope tenant:acme waf.md s-001
sams history       --base memory --scope tenant:acme methodology/waf.md

Claude Code sessions only

For a repo where the only "agent" is your coding assistant, copy templates/claude-code/ into the repo: lean CLAUDE.md, deny rules on curated files, a notes/ scratchpad, and dream.sh, a weekly job that proposes memory changes on a dream/<date> branch for you to review like a PR.

Conformance

pip install -e ".[test]"
pytest

To test another backend, implement sams.backend.Backend and add a factory to conformance/conftest.py.

Storage forms

Roadmap

• v0.2: Postgres/Supabase backend with RLS policies; MCP server exposing the four tools; Postgres in the conformance matrix.
• v0.3: TypeScript port of the harness; adapters for common agent frameworks.

Status

Draft (v0.1). The rules are stable enough to use; names and APIs may change before 1.0. Redaction and flagging are pattern-based safety nets, not guarantees; the human review gate is the control. Feedback and conformance reports from real deployments are the most useful contributions.

License

Code: Apache-2.0. Standard text (STANDARD.md, templates and docs): CC BY 4.0.

Maintained by Final Frontier Ventures.