Memory is an action. Audit it like one.
When an agent writes a memory, it mutates its own future behavior. When it reads one, it retrieves a directive that may shape an answer no one else will see. AAM treats every memory mutation as a state change — and therefore something that should leave a tamper-evident, third-party-verifiable record. Bonis Knox provides that record, vendor-neutrally, above any memory store.
Agents don’t only act. They remember.
The agent stack has been settling into recognizable layers: a control plane decides what an agent may attempt, an identity layer says who the agent is, a runtime executes what the agent decides, and an orchestration framework wires it all together. A fifth seam has now become unavoidable — the memory layer.
Memory entries are not transient. They survive sessions. They shape future tool calls. They influence what the agent tells one user about another. A bad write in March can warp a decision in October. A good write becomes the silent reason a difficult problem gets solved fluently. Either way, the mutation is consequential — and consequential actions need records that survive scrutiny.
AAM’s position has not changed: it is the post-deployment evidence layer for every agent action, across every industry. Memory is one of those actions. The audit-permanence treatment is the same.
Every change to memory becomes a Knox event.
Knox already anchors any event with a canonical byte representation. Memory mutations qualify trivially: each is a discrete change to a content-addressable artifact.
A new memory entry is added. Knox anchors the SHA-256 of the entry, a chain-of-command stamp identifying which agent wrote it under which policy, and the sequence number in the agent's memory stream.
An existing memory entry is retrieved into agent context. Knox anchors the entry hash, the read timestamp, and the operation that triggered the retrieval — useful when reconstructing why an agent answered what it did.
A memory entry is rewritten. Knox anchors both the pre-edit and post-edit content commitments, so the diff is reconstructible from the anchor chain even if the live store has only the latest version.
A memory entry is deleted under a retention or data-subject directive. Knox anchors the redaction itself — proof of removal, with the original content commitment, without making the original bytes recoverable.
A memory store is exported, copied, or migrated. Knox anchors the export-set commitment so any later reconstitution can be checked against what was actually exported.
The retention or access policy on a memory store is itself changed. Knox anchors the policy-document commitment so policy drift is observable across time, not just enforceable at the moment.
What this gives you.
Vendor-neutral
The audit layer is content-addressed, not coupled to any particular memory store. Files, database rows, vector entries, blob objects — all are hashable, therefore all are anchorable. Operators do not have to choose between the audit layer and the memory product they prefer.
Independent verifiability
Anchors are published to the Bitcoin blockchain via OpenTimestamps. Verification does not require Bonis to be online, in business, or cooperative. A counter-party, a court, a regulator, or a future operator can verify the chain with public tools alone.
Privacy-compatible deletion
The anchor commits to a hash, not the memory content. Deleting the underlying entry preserves the audit record without making the bytes recoverable. Redactions are themselves anchored — the deletion event is auditable on its own terms.
Post-quantum resilient
Memory mutations may carry post-quantum signatures via Knox Agent #11 Layer 4 (NIST FIPS 204 / ML-DSA and FIPS 205 / SLH-DSA). The audit chain remains verifiable under threat models that assume future quantum-capable adversaries.
Self-authenticating
Every anchor resolves to a court-ready affidavit architected for FRE 902(13) and 902(14) self-authentication. Admissibility in any given matter remains a determination of the presiding court, but the structural requirements are met by construction.
Above any control plane
Whichever control plane authorized the agent and whichever runtime executed it, the memory anchor is produced and verified outside that stack. The audit layer is independent, by design, of the layer being audited.
Evidence layer, not enforcement.
The doctrine that governs every Knox surface governs this one. Bonis Systems does not access third-party memory stores, does not operate counter-agents, and does not undertake active disruption of any external system. The audit layer is invitational: operators of agents instrument their own memory mutations through Knox if they want the record. The takedown, when there is one, belongs to lawful authority. Bonis provides the evidence.
The substrate is already shipping.
The same primitives that anchor every other Knox event anchor a memory mutation. The endpoints, taxonomy, and verifier are public.