Control what your AI agents are allowed to remember
Carry is the authorization and audit layer for AI memory. It enforces access before memory reaches the model, then renders independently verifiable proof of every decision.
Works with any model · Powered by Sui + Walrus
Persistent memory created a new permission boundary
A support agent with persistent memory can reach everything the system remembers — customer records, billing, internal notes. Should every agent see everything?
Once sensitive memory reaches the model, the access decision has already happened — too late. Carry enforces the decision before retrieval, so denied memory never reaches the model.
- customer_profilereadable
- previous_conversationsreadable
- billing_historysensitive
- internal_risk_notessensitive
- refund_recordsreadable
- admin_instructionssensitive
Engineered for
verifiable memory
Carry is designed from the ground up so every answer can be traced to the exact memory it used — and proven against what it was never allowed to touch.
Gate before generation
Access is enforced at retrieval. The model only ever sees memory it is allowed to use — receipts are honest by construction.
Cross-model memory
Teach one agent and recall from another — even on a different provider. Memory follows the user, not the vendor.
Answer Receipts
Every memory-based answer carries a receipt — memories used, namespaces, source agent, and a Walrus reference, verified.
Every answer carries
its proof.
Your audit trail shouldn't depend on trusting the AI vendor that generated it. Carry renders a structured receipt under every answer — the memory it used, the namespaces it was blocked from — anchored on Walrus so anyone can verify it without trusting us.
Answer Receipt
agent-b · claude
Memory used
- dietauthorizedverified
Prefers vegan meals
Agent A · GPT-4owalrus:0x9f2c…a7e1 - projectauthorizedverified
Is building “Carry”
Agent A · GPT-4owalrus:0x41b8…0c3d
Blocked by policy: health
never retrievedAnchored on Walrus
blob:0x7d3e…ff90
Carry doesn't replace your memory stack.
It governs it.
Keep the memory systems you already run. Carry sits in front of them, enforces the access policy before retrieval, and attaches verifiable proof to every answer.
Ships today: CLI · MCP · LangGraph · OpenAI Agents SDK · Vercel AI SDK
Built for teams
with agents in production
Carry is for teams deploying agents against memory that actually matters — customer records, employee context, regulated data.
Customer support
Support agents answering from customer conversations, order history and billing — without reaching internal notes or admin context.
Enterprise copilots
Agents serving employees with different roles and permissions, where what the copilot may recall depends on who is asking.
Regulated AI
Agents working with financial, healthcare or identity data, where every retrieval decision needs evidence that stands on its own.
Memory you
can prove
No black boxes. The whole loop is built around one principle: enforce access before the model ever sees a thing.
- 01Teach
Agent A captures facts into namespaces as you chat.
- 02Gate
A policy check runs before retrieval: agent × namespace.
- 03Prove
The answer renders with a receipt of what it used.
- 04Anchor
Store the receipt as a Walrus blob — verifiable from then on.
“AI agents shouldn’t decide for themselves what they’re allowed to remember.”
Carry draws a deterministic authorization boundary before memory reaches the model — and produces independently verifiable evidence afterward.
What you can
verify
A verifiable memory layer: gate-before-generation, answer receipts, and Walrus-anchored provenance for cross-model AI agents.
Live revoke
Flip an agent’s namespace off and it truly loses access — the gate returns nothing.
Access matrix
A simple agent × namespace grid that controls what every agent can touch.
Walrus-anchored
Receipts resolve and verify against Walrus blobs. Tamper-evident provenance.
Owner-controlled
Memory stays under its owner's control — portable, auditable, revocable.
From proof to
platform
We are precise about what is live today versus what is on the roadmap. Here is exactly where Carry is headed.
Live now
Deployed and independently verifiable today.
Verify a live proof- Access gate on Sui mainnet
- Walrus-anchored Answer Receipts
- Walletless proof verifier
- CLI, MCP server, and framework adapters
- Hosted /v1 API and audit console
- Attack lab and threat model
Next up
Making Carry deployable by teams.
Follow along- Organization workspaces
- Mem0 and Zep provider adapters
- Design-partner integrations
- SSO and role-based administration
- Usage metering and billing
Where it goes
The long-term frontier.
Read the vision- Enterprise policy federation
- Cross-company agent trust
- Third-party verifier network
- A standard for portable agent authorization
Frequently
Asked Questions
Still unsure? We use precise language about what is enforced today versus what is on the roadmap — the honesty is the point.
Want specific guidance? Reach out.
Contact usToday revoke is enforced before retrieval in Carry’s access layer — the gate never fetches a revoked namespace. Seal-based per-agent cryptographic enforcement, so even a leaked delegate key cannot read a revoked namespace, is on the roadmap.
By default every memory is a public Walrus blob, and each answer re-checks that those blobs still resolve — so the receipt’s “verified” badge is real, not cosmetic. You can also anchor the full Answer Receipt as its own Walrus blob for tamper-evident provenance. Carry also ships a MemWal (Walrus Memory) mode that stores memory Seal-encrypted via the Walrus Memory SDK.
Yes. Agent A and Agent B can run on different model providers and still share the same gated memory — the proof travels with the answer, not the vendor.
Access is checked at retrieval, before the model sees anything. The model only ever receives memory it is allowed to use, so the receipt is honest by construction.
Most memory tools just store and recall. Carry adds a gate before generation and a verifiable receipt for every answer — control what each agent can use, and prove it.
See memory you can prove
Walk the live demo: teach an agent, switch models, revoke a namespace, and watch the receipt tell the truth.