§ 01 — The Problem

## Why multi-agent systems fail audits.

Every AI agent starts the day with amnesia. Single agents rediscover the same facts every run. Multi-agent pipelines are worse — the planner's decisions never reach the executor, the researcher's findings never reach the reviewer. Teams pass giant prompts between agents and hope nothing important fell off the edge.

In a regulated environment, that's not technical debt. That's a compliance failure. Auditors need to know what the agent knew, when it knew it, and which source grounded the decision. Today, most teams can't answer that question. Attestor is built so you can.

> We had a planner, a coder, a reviewer, a deployer — four agents in a pipeline. None of them knew what the others learned. We were burning tokens on stale context and had no audit trail. Engineering Lead, Fortune 100 Bank

Without Attestor

1. Each agent starts blind — no knowledge of what others learned.
2. Giant prompts between agents burn context tokens.
3. No access control — any agent can overwrite any state.
4. Contradictions from different agents go undetected.
5. Session ends, everything learned is gone forever.

With Attestor

1. Shared memory — planner writes, coder reads, reviewer sees both.
2. Token-budget recall — each agent pulls only what fits.
3. Six RBAC roles, namespace isolation, write quotas per agent.
4. Contradictions auto-resolved, supersession preserved for audit.
5. Persistent across sessions, pipelines, and agent restarts.

§ 02 — Principles

## Four stakes in the ground.

The commitments Attestor will not compromise.

01▸

### Auditability

Every memory is provenance-chained. Every recall is replayable. Every supersession is timestamped. An auditor can reconstruct what any agent knew at any point in time.

02▸

### Determinism

No LLM in the critical path. Same query, same ranking, every time. Unit-testable. SOC2-auditable. Defensible to the SEC, FINRA, and FDA.

03▸

### Multi-agent safety

Six RBAC roles, namespace isolation, contradiction resolution, write quotas. The only memory layer that treats agent teams as first-class and prevents runaway agents from corrupting state.

04▸

### Data sovereignty

Self-hosted. Air-gappable. BYOK encryption. No SaaS middleman. Your data never leaves your infrastructure.

§ 03 — Architecture

## Semantic-first retrieval. Zero inference calls.

When an agent calls recall, six cooperating steps find, narrow, rank, diversify, decay, and fit.

When an agent calls `recall(query, budget)`, a six-step semantic-first pipeline finds, narrows, ranks, diversifies, decays, and fits the most relevant memories into the requested token ceiling. Ten million memories in the store. Your context window never sees more than the budget. Same query, same ranking, always.

Three storage roles, every memory persisted across all three. Lose one role and Attestor degrades explicitly — it never silently returns stale results.

Role 01 Document

#### Source of truth

Content, tags, entity, category, timestamps, provenance, confidence. Postgres 16 by default; AlloyDB, Cosmos DB, DynamoDB, or ArangoDB in the cloud.

Role 02 Vector

#### Semantic surface

Dense embedding per memory. Finds memories by meaning when tags or words don't overlap the query.

Role 03 Graph

#### Relationship traversal

Entity nodes and typed edges. Query "Python" surfaces "Django" via the relationship graph and BFS depth 2.

§ 04 — Temporal Correctness

## Attestor doesn't overwrite. It supersedes.

Every fact in Attestor has a validity window. When a fact changes, the old version is superseded — not deleted. The timeline is replayable to any point in the past. Auditors can reconstruct exactly what the system knew at any historical moment.

v1 JPM CFO is Jeremy Barnum
valid_from: 2022-05 · source: sec.gov/10-K · confidence: 0.98 ↓ superseded on 2026-04-11
v2 JPM CFO is Jane Doe
valid_from: 2026-04-11 · source: wsj.com · confidence: 0.94 ↓ superseded on 2026-04-12
v3 Appointment delayed, Barnum resumes interim
valid_from: 2026-04-12 · source: reuters.com · confidence: 0.91

`recall(query, as_of="2026-04-11")` replays what the system knew on that date. Nothing is deleted. Nothing is lost.

§ 05 — Built for Teams

## Not a chatbot plugin. Infrastructure for agent teams.

01

#### Namespace isolation

Every agent, project, or tenant gets its own namespace. Isolated by default, shared when configured.

02

#### Six RBAC roles

Orchestrator, Planner, Executor, Researcher, Reviewer, Monitor. Read-only observers to full admins.

03

#### Provenance tracking

Know which agent wrote which memory, when, and under which parent session.

04

#### Contradiction resolution

Agent A says "user works at Google." Agent B says "user works at Meta." Attestor auto-supersedes. Full history preserved.

05

#### Token budgets per agent

recall(query, budget=2000). Each agent receives exactly what fits its context window.

06

#### Write quotas & review flags

Prevent a runaway agent from flooding the store with noise. Rate-limit, flag, or tag for human review.

§ 06 — Deployment

## Same API. Every backend. Your infrastructure.

One Python library. One Starlette ASGI container. Six deployment targets — laptop, self-hosted VM, AWS, Azure, GCP, on-prem. The three storage roles swap per column. Your agent code never learns which backend it's talking to.

Laptop · zero config

    $ pip install attestor
    $ attestor api --host 0.0.0.0 --port 8080

#### Laptop

Postgres 16 · pgvector · Neo4j + GDS

Docker Compose. Three storage roles, one command up.

#### Self-host

Postgres 16 · pgvector · AGE

Docker. One database, all three roles. Full SQL audit.

#### AWS

App Runner · Arango Oasis

One engine, three roles. Scale to fleet or to zero.

#### GCP

Cloud Run · AlloyDB

ScaNN vector · pgvector · AGE. Scale-to-zero pricing.

#### Azure

Container Apps · Cosmos DiskANN

Managed DiskANN vector · Gremlin graph · SQL.

§ 07 — Integrate in Three Lines

## Python, REST, or MCP. Pick your interface.

main.py

    from attestor import AgentMemory
    from attestor.context import AgentContext, AgentRole

    # Orchestrator context — root of a multi-agent pipeline
    ctx = AgentContext.from_env(
        agent_id="orchestrator",
        namespace="project:acme",
        role=AgentRole.ORCHESTRATOR,
        token_budget=20000,
    )

    # Spawn sub-agents with inherited provenance
    planner = ctx.as_agent("planner", role=AgentRole.PLANNER)
    planner.add_memory(
        "Use event sourcing for the order service",
        category="technical",
        entity="order-service",
    )

    # Executor reads what planner wrote — same namespace, ranked recall
    executor = ctx.as_agent("executor", role=AgentRole.EXECUTOR)
    results = executor.recall("order service architecture", budget=2000)

HTTP · Starlette ASGI

    # Run as a REST API
    $ attestor api --host 0.0.0.0 --port 8080

    # Eight endpoints, Terraform templates included
    POST /add      /recall   /search   /timeline  /forget
    GET  /stats    /memory/:id              /health

    # Response envelope
    { "ok": true, "data": { ... }, "meta": { "latency_ms": 2.1 } }

.mcp.json

    {
      "mcpServers": {
        "attestor": {
          "command": "attestor",
          "args": ["mcp"]
        }
      }
    }

Eight tools exposed to any MCP client: Claude Code, Cursor, Windsurf, or a custom agent speaking stdio MCP.

§ 08 — For Claude Code

## Three words in your terminal.

Not a config file. Not an MCP setup guide. Three words. Attestor interviews you, installs itself, wires the hooks, and runs a health check before you've put the kettle on.

> install agent memory

Paste into Claude Code · Global or project scope · Auto-merges MCP config

§ 09 — Editions

## Open at the core. Hardened at the edge.

Community

### Open Source

- MIT licensed, self-hosted
- All core features
- Five deployment targets
- GitHub issue support

Free. Forever.

Read the docs →
Pro · Q3 2026

### Pro

- Everything in Community
- Observability dashboard
- SSO + SCIM
- Priority support

Contact for pricing

Join waitlist →
Enterprise · Q4 2026

### Enterprise

- Everything in Pro
- FINRA redaction pack
- BYOK encryption
- Audit export · Splunk / Datadog
- SLA + dedicated support

Contact for pricing

Speak with sales →