MAP-Graph: Provenance-Aware Shared Memory for Multi-Agent Workflows

2026-08-11

AI Summary

This work addresses the security risks in multi-agent workflows arising from uncontrolled access to shared memory due to insufficient provenance-aware permissioning and risk awareness. The authors propose a typed execution graph framework that unifies the modeling of agents, provenance, memory, claims, and actions, and—novelty—treats provenance as a runtime control signal to explicitly distinguish hard authorization from graded trust. By integrating lineage tracing, permission filtering, semantic retrieval, multiplicative path-based trust scoring, and a risk-sensitive gating mechanism, the system dynamically adapts evidence usage policies under high-risk actions. Evaluated on 2,700 synthetic tasks, the approach achieves a 94.96% task success rate, 72.70% decision accuracy, and 90.22% clean success rate. Ablation and transfer experiments further validate the contribution of each component.

Abstract

Shared memory helps language-model agents reuse information across long workflows, yet relevant evidence may not be admissible for a particular agent or action. Because restrictions propagate through derivations, summaries can conceal private, poisoned, untrusted, or revoked sources, enabling unauthorized reads or unsafe actions. Existing approaches provide semantic retrieval, scoped access, or lineage tracking, but do not clearly separate hard authorization from graded trust or adapt evidence requirements to action risk. We introduce MAP-Graph, a provenance-aware memory layer that represents agents, sources, memories, claims, and actions in a typed execution graph. It traces ancestry, excludes permission-ineligible records, reranks eligible memories by semantic similarity and multiplicative path trust, and applies a risk-sensitive gate before action execution while retaining affected lineage for audit. On a controlled benchmark of 2,700 synthetic tasks per method across three domains, MAP-Graph achieves 94.96\% overall task success, 72.70\% exact decision accuracy, and 90.22\% in the clean setting, where success requires a correct \textsc{Allow} rather than a safe intervention. Ablations isolate the roles of permission filtering, path trust, and action gating, while transfer tests with two additional backbones preserve the exact-decision and access-control advantages. These results support provenance as an operational control signal, rather than only post-hoc audit metadata, within the evaluated setting.

Problem

• provenance
• shared memory
• multi-agent workflows
• authorization
• trust

Innovation

• provenance-aware
• multi-agent workflows
• shared memory
• risk-sensitive gating
• path trust