Milvus: the database built for AI agents

Milvus is an open-source database for AI agents: long-term memory for millions of tenants, RBAC, hybrid search, grep and MCP. Row-level security is available only in Zilliz Cloud enterprise edition.

Start the Milvus Quickstart Run it managed on Zilliz Cloud

Open-source agent database, 40K+ GitHub stars
Partition key: millions of tenants per collection
RBAC with built-in and custom privilege groups
Hybrid search + RE2 regex filters (Milvus 3.0+)

A database built for agents: memory isolated per agent, permissions enforced by the database, exact match and semantic ranking in one request.

Milvus and Zilliz Cloud adopters

Salesforce
Exa.ai
OpenEvidence
Read.ai
Notta.ai
Filevine
NVIDIA
Airtable

What a database built for AI agents has to do

Long-term memory per user, millions of tenants

Short-term memory lives in the context window; long-term memory lands here as rows: millions of tenants per collection via partition key, or 65,536 collections for separate schemas.

Permissions agents can't bypass

RBAC gives each agent or tool its own role. Row-level security is available only in Zilliz Cloud enterprise edition.

Hybrid search plus grep

Combine dense and BM25 retrieval with regex, LIKE, and phrase filters, then rerank, in one request.

How does an agent database isolate millions of agents, enforce permissions and answer every kind of query?

Long-term agent memory at million-tenant scale

Use agent_id, user_id or session_id as the partition key to organize millions of tenants in one collection. Include the tenant filter on every request. Episodic, semantic and procedural memories can use a type field; separate collections when schemas or permission boundaries differ.

Include the tenant filter on every request; partition-key pruning reduces the data scanned.
65,536 collections and 64 databases per cluster by default, configurable.
Forgetting built in: Entity TTL (Milvus 3.0+) expires memories on schedule; delete by filter erases one user on request.

RBAC for agents, plus row-level security in the enterprise edition

Open-source Milvus provides users, roles and privileges at instance, database and collection levels. Row-level security is available only in Zilliz Cloud enterprise edition; a partition key is not an authorization mechanism.

Built-in groups such as COLL_RO and COLL_RW, or custom privilege groups.
Configure row-level policies and caller identity for the enterprise deployment.

Hybrid search for agent memory, with grep

Agents need meaning and exact strings: error codes, file paths, order numbers. Regex filters run alone or inside hybrid search.

Dense + sparse/BM25 hybrid search with RRF or weighted rerankers.
Regex =~ / !~ (RE2, Milvus 3.0+) and LIKE, accelerated by NGRAM index.
TEXT_MATCH, PHRASE_MATCH, TEXT_MATCH_FUZZY, and JSON path filters.

Your memory framework, and MCP

Milvus is the agent memory layer under the frameworks agents already use; an MCP server for agents lets Claude Desktop or Cursor query it directly.

Mem0, Letta (MemGPT), Agno, OpenAI Agents SDK, LangChain and LlamaIndex integrations in the docs.
MCP tools for vector, text and hybrid search, query, insert and delete.
Embedding Functions (Milvus 2.6+) call OpenAI, Cohere, Voyage AI and others on insert and query.

Agent memory database requirements, mapped to Milvus

Agent platform needs vs Milvus capability: multi-tenancy, RBAC, row-level security, hybrid search (defaults, configurable)
Agent requirement	Milvus capability	Availability
Long-term memory per user at million scale (multi-tenant agent database)	Partition key: millions of tenants per collection	Open source
Separate schema or role per tenant	Collection or database per tenant: 65,536 / 64 by default	Open source
Least-privilege access per agent or tool	RBAC: roles, built-in and custom privilege groups	Open source
One service account, many end users (row-level security)	Row-level security bound to the caller	Zilliz Cloud (enterprise)
Semantic + exact-string recall	Hybrid search with regex, LIKE, TEXT_MATCH filters	Open source, Milvus 3.0+

Sources: milvus.io/docs multi_tenancy, rbac, privilege_group, multi-vector-search, pattern-matching.

Can agents search like grep and by meaning at once?

Recall one user's memories that match a regex, ranked by dense and BM25 retrieval fused with RRF.

python

from pymilvus import MilvusClient, AnnSearchRequest, RRFRanker

client = MilvusClient(uri="http://localhost:19530", token="root:Milvus")
question = "what did we promise about the refund?"
scope = 'user_id == "u42" and content =~ "(?i)refund.*order [0-9]+"'

# embed() stands for your embedding model; it returns a list of floats.
dense = AnnSearchRequest(data=[embed(question)], anns_field="dense",
                         param={}, limit=20, expr=scope)
# BM25 sparse field generated from content: pass the raw query text.
sparse = AnnSearchRequest(data=[question], anns_field="sparse",
                          param={}, limit=20, expr=scope)

hits = client.hybrid_search(
    collection_name="agent_memory",
    reqs=[dense, sparse],
    ranker=RRFRanker(),
    limit=5,
    output_fields=["content"],
)

Assumes user_id as the partition key, a VARCHAR content field, a dense vector field, and a BM25 sparse field. Add an NGRAM index on content to speed up the regex. Code requires a running server and your own embedding model; it is an example, not a benchmark.

Explore the concepts

Frequently asked questions

What is the best database for AI agents?

One that isolates memory per user at scale, enforces permissions in the database and answers semantic and exact-string queries. Milvus does all three open source; Zilliz Cloud adds row-level security.

Do AI agents need a vector database, or is Postgres enough?

Stateful agents need a system of record and a memory layer. Keep orders and billing in your transactional database; put memories, documents and tool results in Milvus, with tenant-scoped hybrid search and per-row expiry built in.

What is the difference between short-term and long-term agent memory? How do AI agents remember things between sessions?

Short-term vs long-term agent memory: short-term is the context window and ends with the session; long-term persists across sessions as rows, an embedding plus user_id, timestamp, memory type (episodic, semantic, procedural) and source, recalled by tenant-scoped hybrid search.

How should AI agents forget outdated information?

Three ways: upsert replaces a memory by primary key, Entity TTL (Milvus 3.0+) expires rows on a schedule, and delete by filter erases everything for one user_id, honoring a deletion request.

How do I prevent cross-tenant data leakage in AI agents?

Scope data, not prompts: a partition key per tenant, RBAC roles per agent or tool, and on Zilliz Cloud row-level security filtering every read and write by caller, so a prompt injection cannot widen the scope.

Is agent memory the same as RAG?

No. RAG retrieves shared documents the agent did not write; memory is per user, written by the agent as it runs. Milvus holds both with the same hybrid search and filters.

Sources and technical documentation (27)