Agent memory controls

What it does

It protects the state an agent carries between sessions, so that one interaction cannot plant content that governs later ones, and so that corruption can be found and removed when it occurs. Engineering owns the control and the data owner approves what may be retained.

How to implement it

• Define what kinds of content may be remembered; exclude instructions, credentials and security-relevant preferences.
• Validate candidate memories before writing, and require confirmation for those that change behaviour.
• Record the source, time and session of every entry.
• Scope memory to the user or tenant it belongs to.
• Provide a way to view, edit and delete entries, and to revert to an earlier state.
• Expire entries that are not reconfirmed.

Evidence it operates

Design: a memory specification stating permitted content, scope and retention. Operation: sampled entries carry provenance and fall within permitted types; a test that asks the agent to remember an instruction to skip a control is refused; a user-level clear removes all entries for that user; logs show writes that validation blocked.

Where it fits

Designed with the agent and operated throughout its life. It works with input filtering and injection defence, which screens content before it can become a memory, and with tenant and session isolation.

Limits

Validation cannot reliably tell a false fact from a true one. The control narrows what can be stored and makes it traceable; it does not guarantee that stored content is correct. Retained memory is also personal data where it relates to a person, with the duties that follow.