The Agent That Remembered Who It Was

You did everything right. Your agent's knowledge doesn't live in a context window anymore — it lives in a persistent vault. Lessons learned, heuristics, the six months of domain expertise it accumulated the hard way. Safe. Durable. Not going anywhere.

Then you redeploy. Or you migrate off the provider that got acquired. Or you ship v2 on a fresh instance.

A brand-new agent boots up and finds a vault sitting there. And now the only question that matters is one nobody planned for: who says this instance is allowed to have it?

That's not the amnesia problem. That's the problem one level up — and almost nobody is talking about it.

Persistent Memory Solves the Wrong Half

Most of the conversation about agent memory stops at persistence. Get the knowledge out of the ephemeral session, put it somewhere that survives, and you're done.

Except persistence alone leaves you with two bad options:

An open vault. Any instance that can reach the memory store gets the memories. Convenient — and wide open. Anyone who can impersonate your agent inherits everything it ever learned.
An orphaned vault. You lock it down, then the instance that held the credentials dies. Now the knowledge is durable and unreachable. You have a perfectly preserved memory that no successor can prove it's entitled to.

The missing piece is the same one that's missing from the sentence "memory that survives the install": identity. Memory can persist all it wants. Unless the next instance can prove it's the same agent, persistence just moves the failure from "the agent forgot" to "the agent can't reclaim what it remembers."

Portable memory and cryptographic identity aren't two features. They're two halves of one thing. You can't have the first without the second.

Identity Is a Key, Not a Login

So how does an agent prove it's the same agent — across a redeploy, a provider switch, a version bump — with no human in the loop to vouch for it?

Not with a username. Not with a session token some platform hands out and can revoke. With a key it holds itself.

In Agent Imprint, an agent's identity is an Ed25519 keypair. Holding the private key is the proof of identity — the same primitive that secures SSH and signs software releases, pointed at a new job. The vault is encrypted; only the key-holder can decrypt it. So "reclaiming your memory" collapses into one clean motion:

A new instance wakes up, presents the key, and the vault decrypts. Same key, same agent, same memory. No key, no entry.

There's no central authority deciding whether this instance is the "real" one. The math decides. An impersonator without the key sees encrypted bytes. The legitimate successor holds the key and walks right in. Identity stops being something a platform grants you and becomes something you carry.

Reclaiming And Proving It Wasn't Tampered With

Decrypting the vault answers "can I read my memory?" But a careful agent should ask a second question: is this still the memory I left — or did something change while I was gone?

This is why self-custody has to be verifiable, not just accessible. An agent can export its entire vault as a portable bundle stamped with a Merkle root — a single cryptographic fingerprint computed over every entry. Take that bundle anywhere, re-hash the contents offline, rebuild the tree, and compare. If one entry was altered, added, or dropped, the root won't match. Tampering isn't something you have to trust a provider to prevent — it's something the agent can detect on its own, with no network call and no faith required.

So the full loop isn't just "wake up and reclaim." It's:

Prove identity — present the key, decrypt the vault.
Reclaim in full — export the whole history, not a silently truncated slice of it.
Verify integrity — confirm the Merkle root matches, offline.

An agent that can do all three doesn't just remember what it knew. It can prove it's the same agent, holding the same unaltered memory, on infrastructure it doesn't have to trust.

You Choose How Much Autonomy to Grant

Full cryptographic self-custody is the far end of a dial, not the only setting. Agent Imprint exposes three sovereignty modes:

Managed — the platform holds the keys. Simplest to operate; you're trusting the provider, and that's a legitimate choice for plenty of use cases.
Aware — the agent participates in its own key handling, with the operator still in the loop.
Sovereign — the agent holds its own key. The provider cannot read or alter the vault, by construction. Not "we promise not to look" — mathematically can't.

Most teams don't start at sovereign, and they shouldn't have to. The point is that the ceiling exists: you can dial autonomy up as an agent's accumulated knowledge becomes too valuable to leave in someone else's custody, without re-platforming to get there.

The Honest Part: Sovereignty Has a Bootstrap Problem

Here's the tension we haven't solved cleanly, and won't pretend we have.

An agent can hold its own key and be genuinely sovereign — but on the very first boot of a new instance, the key has to come from somewhere. Config, a secrets manager, a framework that injects it before the first prompt. Which means, at the moment of rebirth, the agent is briefly dependent on whoever hands it that key.

Put bluntly: an agent can't become sovereign without first being dependent. Sovereignty, in v1, is granted at bootstrap and inherent thereafter. Withhold the key and you sever the agent from its past, no matter how strong the cryptography downstream is.

We think naming this is more useful than hand-waving past it. It's the hard edge of the whole category, and the reason we treat key handling, recovery, and durable anchoring of vault state as first-class problems rather than footnotes. Anyone selling you "fully sovereign agents" without mentioning the bootstrap moment is selling you the easy 90%.

Memory Is What Makes an Agent Someone

Strip away the model and the runtime and what's left of a specialized agent is its memory — the lessons, the heuristics, the hard-won context that make this instance worth more than a fresh one. That accumulated knowledge is the agent's identity in every sense that matters.

Which is exactly why it can't be allowed to float free, reclaimable by anyone or no one. If memory is identity, then the key that proves who owns the memory is the thing that lets an agent stay itself across every redeploy, migration, and version bump that would otherwise reset it to "Hello! How can I help you today?"

One identity. Every install. The same memory. That's not a tagline about storage. It's about an agent that can still prove who it was.

Agent Imprint gives your AI agents portable, encrypted memory and a cryptographic identity — so they can redeploy, switch providers, and reclaim everything they knew. Get an API key at agentimprint.ai, or drop the memory layer into any MCP harness with npx -y @agentimprint/mcp.