Catalog-bound authority: lifecycle control over records you do not store

An experiment report on governing AI-agent memory held in an external store the operator neither owns nor can delete from. Ownership is split by role rather than by location: the external provider keeps content, embeddings and similarity search, while a local catalog keeps identity, exact version, provenance, lifecycle status and a keyed content fingerprint. Search returns references, never bytes. Policy is evaluated on the catalog, and only after an allow decision does the boundary fetch that exact version itself and verify the fingerprint. Two non-obvious properties follow: a denied record is never fetched at all, so its content never leaves the provider; and revocation works without deletion, because it becomes a property of the disclosure path rather than of storage. The arrangement was verified as an executable matrix of ten checks against an in-process fixture. The note states in full what the fixture does not demonstrate, including the unresolved question of who may write to the catalog. Text in English and Russian.