Agent memory: scoped, provenance-rich, revocable context

Agent memory is application-managed state, not human memory and not guaranteed truth. Stored observations, summaries, embeddings, and preferences can be stale, contradictory, poisoned, over-broad, or sensitive.

Mental model

• Generative Agents describes storing experience records, synthesizing reflections, and retrieving memories for planning in a simulation. Use the architecture as a research pattern, not proof that summaries are true or safe.
• MemGPT studies tiered context management inspired by virtual memory. Separate working context and durable stores without promising unlimited or lossless memory.
• OWASP identifies vector weaknesses, prompt injection, disclosure, and excessive agency risks. Treat memory and retrieval as untrusted, scoped inputs.
• NIST's Generative AI Profile includes privacy, information integrity, governance, and incident considerations. Add provenance, consent, correction, retention, and deletion controls.

Guarantees and boundaries

• Every durable item has subject, source, purpose, policy version, and retention state.
• Derived objects reference deletable source identities.
• Memory content never grants tool authority.

Diagram scenarios

Consented durable memory write. A durable memory is created only for a declared purpose with provenance and retention metadata.

Scoped memory retrieval. Retrieval returns candidates and provenance; it does not declare them current or true.

Poisoned memory and summary drift. An attacker or summarizer can insert false instructions or erase qualifiers.

Correction, expiry, and deletion. A control operation reaches source events, derived vectors, summaries, caches, and active context.

Architecture decision

Separate ephemeral working state from durable user-approved memory, record source and confidence, scope retrieval by subject and purpose, treat retrieved memory as untrusted, and provide correction, expiration, export, and deletion across all derived stores. Never use memory alone to authorize an action.

Failure modes

• Summaries can hallucinate, compress away qualifiers, or conflict with source events.
• Approximate retrieval can surface the wrong subject or stale preference.
• Deletion can be partial while backups or mandated retention remain and must be reported honestly.

Operational checklist

• Separate working, episodic, semantic, and derived summary lifecycles.
• Require user-visible controls for durable memory where appropriate.
• Red-team cross-tenant retrieval, poisoning, conflicting memories, and injection.
• Test correction and deletion through vectors, caches, backups, and active sessions.

Related concept

Primary sources

1. https://arxiv.org/abs/2304.03442
2. https://arxiv.org/abs/2310.08560
3. https://genai.owasp.org/llm-top-10/
4. https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf