Intent-Bound Memory Authorization Against Persistent Agent Poisoning

Sealing-Jutsu a CapsuleGuard introduces an intent-bound memory authorisation architecture designed to protect LLM agents from persistent memory poisoning attacks. Instead of treating retrieved memory as automatically trusted, the framework approaches memory influence as an authorisation problem — applying least-privilege controls before stored memories are allowed to affect reasoning, planning, or tool execution. The paper introduces the concept of intent-bound memory capsules, where every memory carries scoped permissions such as topic boundaries, denied actions, authority levels, influence budgets, lineage tracking, and verification requirements. The core idea behind the architecture is straightforward: retrieval should not automatically imply trust or authorisation. Using the open-source prototype CapsuleGuard, the research evaluates defences against several advanced attack classes, including delayed-trigger poisoning, trusted-source compromise, retrieval-time privilege escalation, cross-session manipulation, OCR and multimodal memory injection, and experience poisoning attacks. Across synthetic benchmark evaluations, the architecture achieved a 0.00% attack success rate while maintaining 100% benign accuracy, demonstrating the effectiveness of least-privilege memory authorisation in long-term agent memory systems. The work positions memory security as an emerging and still largely unexplored layer of agentic AI security. By combining ideas from capability security, access control, and modern LLM agent architectures, the research proposes a practical defensive model for securing persistent autonomous AI systems.