Agent memory is safe only when the system knows where it came from

Five kinds of state

Production agent systems normally need several categories of state. Each category has a different owner and lifecycle.

1. Conversation context: the recent interaction needed for coherence.
2. Workflow state: current step, completed work, timers, retries, and pending approvals.
3. Business state: authoritative records, permissions, transactions, and current system facts.
4. Episodic evidence: what happened during one run, including inputs, outputs, tool calls, and decisions.
5. Reusable knowledge: approved policies, patterns, prior cases, and organization knowledge that may inform future work.

Provenance fields are part of the data model

A memory item should include source, authority, observed time, effective time, scope, trust state, retention, and supersession. Without those fields, retrieval can return text that is semantically relevant but operationally wrong.

• Verified fact, proposed interpretation, disputed claim, or unknown
• Tenant, user, case, role, and environment scope
• Source document, system record, person, or generated output
• Policy or reviewer that approved the item
• Effective and expiration dates
• Superseded-by and contradicts relationships

Memory is not policy

An agent may remember a prior exception or a user's preference. That does not mean the record is allowed to override current policy. Policy, authorization, and prohibited-use rules should remain in a separately governed layer that retrieved memory cannot rewrite.

This distinction is especially important for long-running work. A previously approved plan may be invalid after a model change, personnel change, new regulation, data update, or revoked credential.

Vector retrieval can widen access

Semantic similarity ignores organizational boundaries unless the application enforces them. Access checks should be applied during candidate retrieval and again before context is assembled. Post-generation filtering is too late because unauthorized content may already have influenced the result.

Memory poisoning is another risk: untrusted content can be stored and later retrieved as though it were organization knowledge. OWASP's agentic guidance treats memory and context manipulation as system-level threats. [S1] [S2]

Durable execution and replay

Long-running work should survive process restarts without re-running completed external effects. Durable workflow engines can preserve event history and replay deterministic coordination. Model calls and external actions should be treated as recorded activities with explicit retry and versioning behavior.

The important control is not a specific product. It is the separation between deterministic coordination, non-deterministic external work, and authoritative business state.

Retention, deletion, and handoff

Memory increases privacy and operational obligations. Retain only what has a declared purpose. Separate transient context from evidence that must be retained and from knowledge that needs periodic review. Support deletion or redaction without destroying the auditability of unrelated records.

Client-owned handoff should include the memory schema, source relationships, retention rules, active and superseded records, and a way to export evidence without preserving inaccessible model-specific embeddings as the only source of truth.

Evaluation cases for memory

Test stale records, revoked access, cross-tenant similarity, conflicting sources, supersession, malicious content, missing source metadata, summarization loss, and recovery after state-store failure. Measure not only retrieval relevance but whether the system used the item appropriately.

Research boundary

This article describes architecture patterns. It does not establish a universal retention schedule or legal basis for processing. Privacy, records, security, and contractual requirements must be resolved for the actual system and jurisdiction.