Who Stores What? Split Memory Custody in Agentic AI

Enterprise language-model agents now handle work that stretches across sessions. They keep customer context, fix mistakes mid-run, enforce policy, and get better over time. That accumulated experience has to live somewhere — and in practice it lives in three places, under two parties who do not fully see each other's writes. That split is the governance problem.

I call the resulting failure mode a memory fork. Prompt rules say one thing; model weights encode another; the agent does something neither side expected. Teams end up duplicating work, debugging without a clean trail, and arguing over who owns the residual risk.

A formal game-theoretic model asks when this split custody stays stable and useful, and when it settles into a low-trust trap. The trap is belief-driven. Contractible observability rights can push the game toward the better equilibrium.

Three Memory Tiers

Modern language-model agents typically stack three complementary memory layers:

• Prompt rules and playbooks — fast, fully inspectable, controlled by application teams.
• External retrieval stores (retrieval-augmented generation caches, episodic databases, checkpointers) — medium inspectability, usually managed by the deployer or platform.
• Model weights (fine-tunes, adapters, reinforcement-learning-from-human-feedback updates) — slow, mostly opaque, controlled by the vendor.

On paper the technical design is clean. Organizationally it is a mess. Application owners govern the inspectable tiers; vendors control the weights and often see aggregate usage traces. Neither side has full real-time visibility into the other's memory writes. Prompt-visible rules drift out of sync with weight-encoded behavior, state gets duplicated across layers, attribution softens, and liability becomes hard to pin down.

Public issue trackers for LangChain, LangGraph, CrewAI, Mem0, and related frameworks show the same pattern over and over: checkpoint corruption, manual pruning, painful rollbacks, and long threads about who changed what.

The Strategic Game

Technical feasibility only gets you halfway. What remains is incentive compatibility under split custody.

We model a sequential game between two rational players: the application owner, who bears task performance and liability risk, and the model vendor, who hosts the base model and can fine-tune on usage traces. The owner chooses the memory architecture — prompt-only, hybrid, or heavy vendor delegation. The vendor then chooses fine-tuning intensity. Payoffs cover task success, reconciliation costs, revenue, and liability under partial observability.

We solve the game with subgame-perfect equilibrium under full information, and Perfect Bayesian Equilibrium when fine-tuning on leaked traces is unobserved.

Findings

1. Hybrid memory can be stable when governance costs stay bounded

Even when prompt-only looks cheaper in the short run, hybrid architectures can be a stable equilibrium when deployers bear reactive governance costs and can moderate what the vendor learns (Proposition 1b). Hybrid is rational when governance cost stays below a surplus-to-labor ratio.

In practice: Teams often respond to drift with manual pruning, new guardrails, or checkpoint migrations — the sort of thing you see constantly in LangGraph and CrewAI issues. When those reactive costs stay manageable, hybrid custody can capture vendor improvements without handing over full control. When governance labor is cheap enough to moderate aggressive fine-tuning, the owner keeps the improvement and still has a usable control surface.

2. Observability and repair rights discipline the vendor

Contractible rights to inspect, roll back, or reconfigure the inspectable tiers act as credible off-path threats. When owner liability exceeds vendor liability, those rights curb aggressive fine-tuning and improve outcomes (Proposition 2). They also select the high-trust equilibrium when hidden fine-tuning would otherwise sustain a pessimistic trap (Proposition 3′).

In practice: A poisoned checkpoint or a stale entity link can force a full process restart when no one has surgical access to the tier. Contractible observability — logging, trace spans, guarded checkpointers — turns those fires into ordinary incidents. Teams that negotiate these rights upfront avoid later fights over who owns a given memory write.

3. The low-trust trap is self-confirming

Under undisclosed fine-tuning on leaked traces, the game admits two Perfect Bayesian Equilibria: a high-trust hybrid equilibrium and a low-trust prompt-only trap (Proposition 3).

Bad parameters do not create the trap. Self-confirming owner pessimism does. Expecting aggressive hidden behavior — for example, the vendor improving weights on traces the team cannot see — the owner stays prompt-only to avoid hybrid risk. That choice removes the observability that would have disciplined the vendor. The vendor then exploits leaked traces, which confirms the owner's pessimism. The loop closes.

In practice: A team burned by unexplained policy drift defaults to prompt-only, even when hybrid would capture useful vendor improvements. The vendor, seeing less structured feedback, leans harder on whatever traces leak through. Drift gets worse. Pessimism looks justified. Both sides lose capability. Observability rights break the loop by making hidden behavior visible and correctable, so the high-trust equilibrium no longer depends on unbacked belief. You audit; you do not need to trust first.

What Teams and Vendors Should Do

Memory governance sits at the intersection of architecture, contracting, and incentives. It is not a routing detail.

For application teams and architecture committees:

• Assign clear owners per memory tier, with explicit reconciliation cadences.
• Put contractible observability and repair rights in vendor agreements; those clauses usually matter more than commercial discount language.
• Prefer hybrid architectures with automation when governance costs sit in a workable range. Improvement without loss of control is available when moderation binds; when moderation fails, observability matters more.

For vendors:

• Publish evaluation deltas when traces inform updates. Visible change builds trust faster than hidden improvement.
• Offer inspectable adapter layers (customer-visible LoRA checkpoints and similar) so hybrid custody is both feasible and attractive.

Split memory custody does not have to stay a permanent source of friction. With clear design and contracting, organizations can move from fragile equilibria toward durable partnerships that use agentic systems without surrendering control of what those systems remember.

Close

Agent memory under split custody is a new problem, but a representative one for information systems. The model shows the low-trust trap is avoidable. Teams and vendors that get observability, repair rights, and tiered permissions right ship more reliable agents — and build systems that stay accountable when the load is real.

Formal theory with illustrative traces. Full working paper (proofs + construct-check appendix) available on request.