I like the idea of separating access control from memory itself. One question I had while reading this: how do you prevent the agent from pulling in too much context? In production systems, we've found that deciding what not to retrieve can be just as important as maximizing recall.