Egress-Bounded Retrieval: A Privacy-Preserving Enterprise Memory Architecture with No External Model in the Retrieval Path

Enterprise assistants need durable, structured memory of an organisation's documents, people and decisions. Two designs dominate practice, and both are unsatisfactory for confidential corpora. Vector-database retrieval augmented generation (RAG) handles lookup but degrades on questions requiring structure or reasoning across documents. Agentic assistants that read files on demand are more capable, but they transmit corpus content to a third-party model provider on every query, and their cost grows with query volume. This is an unacceptable posture for HR, legal and financial material under GDPR.

We describe CognitiveCore, an enterprise memory layer built around a single architectural invariant we call egress-bounded retrieval: no corpus content leaves the customer's trust boundary during retrieval. Organising, indexing, searching and ranking are performed exclusively by small, local, in-process models. An external large language model is invoked only at a final synthesis step, and sees only the short set of passages already selected for the question. The invariant is enforced by construction, since there is no network call to an external model anywhere in the retrieval path, and it is auditable by network-egress inspection.

The system is standards-native: content is organised on the W3C Organization Ontology, schema.org and ArchiMate, so it maps onto vocabulary that enterprise systems already use rather than an invented metaphor. Retrieval fuses five independent strategies (structured lookup, multilingual full-text, dense semantic, graph traversal over people-to-artifact links, and a thematic summary layer), merges and de-duplicates the candidates, re-ranks them with a local cross-encoder, and filters by trust and role-based access before synthesis. Text, vectors and the relationship graph share a single PostgreSQL instance.

We report preliminary results from a working multi-tenant prototype running on a real 511-document corpus. Search latency stays under 10 ms (p50) at 10,000 artifacts with lexical and dense layers fused; pgvector HNSW is 430x faster than a JSONB fallback at that scale. A conservative structure-preserving compression strategy (SEETR) achieves 12.8% token reduction while retaining 99.8% of tagged facts, whereas a key-sentence baseline achieves higher compression (39.6%) at the cost of destroying 37.8% of facts, a trade-off we argue is unacceptable in enterprise settings.

We are explicit about what we have not established. Our retrieval-quality benchmark substitutes hash-based embeddings for a real encoder and therefore does not evaluate the semantic layer; a head-to-head comparison against an agentic baseline is specified but confounded by corpus asymmetry and remains incomplete. We state these openly and set out the resulting research agenda: retrieval quality under the egress constraint, a defensible evaluation methodology for enterprise memory, privacy-preserving passage context, principled trust decay, and entity resolution. We are seeking academic collaboration on precisely these questions.