Agent Memory

Memory purpose and lifecycle

An agent is software that uses a model to select actions. Agent memory is retained application information made available to later interactions. Useful purposes include avoiding repeated questions, preserving preferences, and reusing evidence from earlier work. Retention is optional: a detail with no identifiable future use need not become memory. [1][2]

A constructed project assistant serves Jo, user j17, on Cedar, project c1. On day 1, Jo requests concise reports except for audits; day 2 adds a registry observation; day 3 changes the preference; day 4 brings a forget request. Jo controls personal preferences, the registry controls current project status, and application policy controls access and retention. [3][4][5]

Context Engineering explains how an invocation receives selected information. External records must enter that input before the model can use them. Storing or retrieving records does not itself change learned parameters; training and inference explains that boundary. Parameter adaptation belongs to Continual Learning. [6][7]

A retention policy specifies permitted content, purpose, duration, and conditions ending retention. In this example, preferences remain until changed, forgotten, or the project purpose ends. Application owners define automatic admission; authorized corrections and removal requests alter retained state. Retention schedules establish the broader decision authority. [8][9]

Admission can reject a candidate. Processing can fail after persistence. Searchability and invocation inclusion require separate checks; neither follows merely from accepting a write. [10]

Episodes and reusable assertions

Episodic memory records particular experiences and their circumstances. Semantic memory records reusable assertions about facts, preferences, or relationships. These are architectural categories, as described in CoALA, rather than claims that software reproduces human cognition. Semantic memory describes the information stored, not whether retrieval uses vector similarity. [11][12]

The day-1 episode records Jo requesting concise Cedar reports with an audit exception. Its derived assertion expresses that preference as a reusable default. If Jo changes the preference on day 3, the earlier request still happened; its former default should no longer control new reports. [11][4]

Whole interactions preserve surrounding explanations but require more selective reading. Smaller assertions support precise retrieval and revision, while extraction can discard qualifications. A useful baseline searches stored messages and includes neighboring messages for context, as demonstrated in ActiveGraph. Its reported experiment does not establish that this granularity is universally best. [15]

Procedural memory retains reusable instructions for doing something, rather than a fact about the world. A successful workflow can supply such guidance, but a saved procedure still needs evidence that it transfers to later cases. [16]

A summary that shortens the next input is not automatically a durable memory record. Persistence, retrieval interfaces, and update rules must be provided separately. Compaction and summary fidelity covers the compression operation. [6]

Identity, scope, and evidence

The subject is whom a memory describes; the speaker made the statement; the owner controls its stored record; the requester seeks access. These roles may differ. A namespace groups records under identifiers, but grouping alone does not enforce authorization. [3][12]

Two people named Jo must remain distinct until evidence supports a match. Entity resolution decides whether mentions refer to the same thing; equal names are insufficient. Entity resolution develops that process. Relationships among people, projects, and events can use a graph representation, but memory does not require graph storage. [17][18]

Provenance records origin and transformation history; lineage identifies source-to-derivative links. W3C PROV supplies a vocabulary for entities, activities, and responsible actors. These links enable inspection, not proof of truth. Broader accountability belongs to lineage and audit evidence. [19]

Valid time describes when an assertion applies in the world. System time describes when its version entered database history. A day-3 correction may revise what applied on day 1 without changing what the database knew on day 2. Writing a summary today does not refresh its underlying observations. [21]

A source association can mean support, mention, or invalidation. Zep's documented episode associations include all three kinds of relationship. Counting associations therefore does not count independent corroboration. [22]

Generated confidence is another model output, not independent confirmation. Calibration requires correctness evidence over a specified population. A source reference also has limits: its content can change or disappear, leaving attribution without inspectable evidence. [23][24]

Admission and durable writes

Admission decides whether a candidate deserves durable storage. An explicit remember request supplies a clear purpose; a structured application event supplies identified fields; a model-proposed preference adds interpretation. These routes need different checks. Permission to retain a claim and evidence that the claim is accurate are separate decisions. [2][25]

An application admission rule should check future use, permitted purpose, subject and scope, evidence, sensitivity, expected stability, and duplication. Transient details can be rejected; uncertain interpretations can await review. Purpose-specific extraction instructions help express these choices, but prompted exclusions are not an enforcement boundary for sensitive information. [2][26]

Immediate writes can make a correction available before the next request, but add work to the active task. Background writes reduce that immediate burden while allowing other interactions to see older records. The interface must distinguish a queued update from one whose promised read path is ready. [8]

Track the intended record: a search returning some result does not establish that this newly imported record is searchable. [10]

Idempotent ingestion processes repeated delivery of one logical write without creating additional effects. Assign an operation identity and enforce it with the mutation; merely logging a key accomplishes nothing. Reusing an identity with different parameters should fail. Repeated delivery must not manufacture apparently independent evidence. Safe retries explains uncertain completion. [27]

An outbox commits the authoritative record and an indexing event in one database transaction. A relay later publishes that event, and consumers handle duplicates. This avoids losing indexing intent after the record commits, but search remains a separately completed projection—a derived representation. Runtime recovery belongs to Harness Engineering. [28]

Memory poisoning inserts hostile material into records that later retrieval can reactivate. AgentPoison demonstrates this under an attacker-controlled insertion threat model, without updating model weights. Storage, summarization, and repeated recall do not turn external text into authorized instructions. AI Security explains the trust boundary. [26]

Consolidation and qualified knowledge

Consolidation organizes retained observations into reusable records. A compact profile makes common facts easy to load but concentrates update risk. A collection of smaller assertions permits targeted changes while moving complexity into selection, deduplication, and reconciliation. Neither representation removes the need to preserve evidence. [8]

Jo's record must preserve both Cedar scope and the audit exception. Reducing it to a general preference for brevity loses meaning. Turning a tentative inference into an established preference adds meaning without evidence. Consolidation fixtures should explicitly test negation, exceptions, uncertainty, and project boundaries rather than grading only shorter output. [20]

Duplicate text and equivalent meaning are different properties. A copied episode supplies no new observation; a nearly identical revision can change a decisive date or negation. Content fingerprints and similarity checks help organize records, but cannot decide semantic equivalence alone. Duplicates and revisions develops that distinction. [29]

Reflection converts feedback into proposed guidance. Reflexion separates an Actor producing actions, an Evaluator judging the attempt, and Self-Reflection producing text for later attempts. This changes subsequent input rather than model weights. An unreliable evaluator can generate an unreliable lesson, and a plausible explanation does not establish the cause of failure. [30]

Offline consolidation can compare saved notes with earlier traces and repair task-local mistakes. The long-horizon Claude talk calls this process dreaming. Its output still requires evaluation: moving interpretation outside the active task provides another opportunity to inspect evidence, not an automatic correctness guarantee. [31][32]

Keep source links through extraction, identity merging, and reconciliation. Those links identify which assertions need reassessment after a correction. Compaction mechanics can reduce input size; consolidation additionally needs a maintained relationship between retained sources and reusable conclusions. [33][34]

Retrieval and justified use

A small profile can supply recurring defaults, while on-demand retrieval brings in task-specific episodes. The choice controls which information reaches later work, not merely where it is stored. Recall policy therefore deserves evaluation alongside admission and retention. [35][36]

Lexical retrieval matches terms; vector retrieval compares learned representations. Either can help locate records. Search and Retrieval covers their algorithms. A memory query also needs the current task, subject, project, and relevant time; conversational resemblance alone leaves these conditions unspecified. [37]

Eligibility constrains consideration; ranking orders eligible records. Apply identity, scope, permissions, validity, and removal rules before disclosure. Filtering a small global shortlist afterward can leave no useful results even when eligible matches exist. A higher similarity score cannot repair a violated eligibility condition. [39]

Within the eligible set, relevance, specificity, recency, and evidence quality can compete. Generative Agents combines relevance, recency, and importance in its simulated setting. That demonstrates a composite policy, not universal weights: an older explicit preference can remain more useful than a newer incidental mention. [14]

The ranked retrieval response preserves record and revision IDs, source references, times, and execution status. A successful empty search supports only that no eligible result was found by that search. An unavailable search does not establish absence. Selection must not erase this distinction. [37][28]

Under the fixture's authority rules, Jo's preference is a scoped default that a current authorized instruction can change. A remembered Cedar status requires a registry refresh before a present-state claim. If evidence remains unresolved, qualify it historically, omit personalization, or request the missing clarification. Conflicting sources should remain visible rather than being silently collapsed. [40][41]

Selection for the next decision and refreshing changing information govern the supplied view. Remembered approval is historical evidence, not current permission to act. Authorize the actual operation under its present scope. [42]

Correction, supersession, and disagreement

Supersession ends an assertion's current applicability in favor of a replacement while preserving history only as permitted. An appended correction is insufficient if retrieval still selects the old assertion. The replacement and affected derivatives must become visible through the read paths future tasks use. [34]

A recent write may contain old evidence. Before declaring a contradiction, compare subject, scope, applicable time, and source authority. Different projects or periods can support different assertions without conflict. Rebuild affected profiles and search copies from the accepted evidence rather than merely adding a newer timestamp. [43][44]

Optimistic concurrency rejects a write whose basis revision has changed. HTTP If-Match provides this precondition for one resource. The pseudocode assumes all profile-affecting corrections advance its revision atomically; evidence snapshots are identified. Other outcomes require reconciliation. [45]

def consolidate(profile_id, admitted_update):
    for attempt in range(3):
        base = read_profile_and_evidence(profile_id)
        draft = derive(base, admitted_update)
        if not preserves_scope_and_exceptions(draft, base):
            return "review_required"
        result = publish_if_revision_matches(
            profile_id,
            expected_revision=base.revision,
            content=draft,
        )
        if result == "committed":
            return "committed"
        if result != "precondition_failed":
            return "reconcile_operation"
    return "review_required"

A worker deriving from v4 must reassess after Jo's Cedar correction creates v5. Its independently supported Birch update can survive recomputation, alongside unrelated facts. Attaching v5's tag to stale content defeats the check's purpose; recomputing without a conditional publication leaves another race. [45]

Version checks and deduplication answer different questions: whether the basis remains current, and whether an operation already happened. After an ambiguous result, reconcile or retry the same operation identity under the endpoint's contract. A new identity can duplicate an effect. One resource precondition does not provide a multi-resource transaction. [27][45]

Expiry and continued usefulness

Time-to-live, or TTL, is a configured lifetime. LangGraph's store source describes adapter-dependent expiry, normally refreshed by access, with best-effort deletion and optional expiry filtering. Frequently retrieved content can therefore remain stored even when its factual content is old. Storage expiry is not a freshness evaluator. [9]

Cedar's deployment observation may need revalidation after a deployment, while Jo's preference remains applicable until changed or its purpose ends. HTTP caching offers a useful reuse-contract analogy: age and validation govern reuse, not business truth. Neither summarization nor repeated access should reset the source's age or override the application's retention deadline. [46][47]

Withholding, revalidation, and deletion are different policy outcomes. Expiry need not make an earlier observation historically false. Refreshing information governs current use; retention schedules govern how long copies may remain. [46]

Forgetting across derived records

On day 4, Jo requests removal of Cedar reporting preferences. In this fixture, that covers preference memories and their derivatives, with future automatic preference collection for j17/c1 disabled until re-enabled. It does not delete Cedar's business records. The request's subject, content category, project scope, and future handling rule must be explicit. [12][48]

Follow lineage through episodes, assertions, profiles, summaries, search representations, caches, and processing copies. Delete unsupported derivatives or rebuild mixed artifacts from remaining permitted evidence. Retain unrelated content. Multiple source links require content-level reassessment; their existence alone does not establish that every surviving statement has independent support. [49][22]

Zep documents a concrete residual: deleting an episode does not regenerate shared-node names or summaries, so deleted information can remain. Removing an episode that invalidated a fact also does not restore that fact. Source deletion and semantic forgetting have different completion conditions. [50]

A tombstone is minimal metadata recording removal so older work can be rejected. For this application, publication must atomically check a durable removal generation or equivalent version condition against the pending write. Otherwise a worker can pass a check, race with deletion, and recreate the record. Avoid retaining the forgotten payload in the suppression metadata. [51]

Keep suppression effective for the possible replay horizon, or bound and retire old work. Search-engine deletion history can expire; it is insufficient as the only resurrection guard. Cancellation is also scoped: Zep describes canceling pending items after target deletion, not a guarantee covering every selective forget request or later import. [51][48]

Report immediate non-use separately from completed cleanup. An index acknowledgment need not establish search invisibility. Track each destination and verify its boundary; backups, vendors, and retained processing copies may have different completion conditions. Lifecycle fulfillment across derivatives supplies the broader accountability model. [51][52]

Evaluation across interactions

Memory evaluation needs later tasks with known preceding state. A fresh conversation cannot reveal every failure that appears after accumulated interactions. Loading an existing history and testing its continuation makes late failures reproducible; the Alyx team describes this approach for long-session context failures. [53]

Add distractors, same-name people, other projects, unresolved contradictions, expiry, and failed retrieval. LongMemEval separates indexing, retrieval, and reading, and includes temporal reasoning, knowledge updates, and abstention. Its curated tests help localize failures; they do not verify an application's deletion, identity isolation, or complete lifecycle. [38]

LoCoMo links answers to supporting conversation turns and compares histories, extracted observations, and summaries. Evidence-linked cases allow inspection of whether the right information was found separately from whether the answer used it correctly. Generated and edited histories remain distinct from longitudinal deployment evidence. [55]

Compare no persistent memory, simple scoped retention, and the proposed policy with the same model, tools, tasks, and source access. Report latency and processing differences. Remove or substitute selected memories to determine whether the current request already supplies the answer. Controlled comparisons explains the experimental design. [56][35]

Freeze source and derivative snapshots at each information cutoff. Selecting a past valid date using current database knowledge can leak later corrections. Historical replay needs both the applicable period and the knowledge available then; temporal queries develops this distinction. [57]

A proposed repair should improve a replayable failure case and preserve covered prior behavior. Define success before running candidates, including expected non-use after forgetting. Passing retained tests supports only their coverage, so correction and deletion scenarios need their own checks. [58]

Failure diagnosis and policy revision

A failed audit report can originate before retrieval. If the source contains Jo's audit exception, extraction drops it, and the shortened assertion reaches the model, the earliest demonstrated error is representation loss. Retrieving more copies of that assertion does not restore the missing qualification. [20]

Retrieval recall uses eligible useful records as its denominator; precision uses returned records. Count distinct records under the same snapshot and identity policy. Declare zero-denominator handling: no useful records makes recall undefined, and no returned records makes precision undefined. Report unavailable retrieval separately. End-to-end success instead counts later tasks. [55][38]

Negative transfer occurs when retained information worsens later performance. The long-horizon Claude demonstration shows a wrong location memory repeatedly inducing the same game error. Consistency alone is also insufficient: a stable answer can be wrong. Measure correctness alongside unnecessary questions, unsupported personalization, stale claims, and disclosure failures. [61][62]

Check whether the tested mechanism actually ran. A short evaluation that never triggers compaction says little about compaction quality. Similarly, a forgetting test that never recalls or re-ingests the affected information misses its critical behavior. Track correction and deletion completion, latency, storage, and processing work as separate outcomes. [63][58]

Diagnostic records should identify memory revisions, policy versions, processing outcomes, selected records, submitted input, and observed results. General tracing conventions do not automatically capture every application revision. Apply a bounded capture policy, minimizing content so telemetry does not become an unmanaged second memory store. [64]

Failure analysis separates competing explanations before a repair. Evidence may justify better admission, faithful consolidation, narrower recall, or shorter retention. It may also justify removing a memory feature. Offline revisions earn their compute cost through improved later behavior, not through plausible-looking notes. [32][65]

Open questions

1. 01

   Consolidation needs reliable acceptance criteria for exceptions and uncertain preferences. Fluent summaries can conceal semantic loss, while exhaustive review is expensive. Progress would preserve qualified assertions across repeated consolidation and reject unsupported generalizations on held-out cases. [30][32]

2. 02

   Authority resolution remains application-dependent when current records, intended behavior, and human corrections disagree. Recency and organizational rank do not settle truth. Progress would identify conflicts requiring escalation while resolving explicitly governed cases without silently discarding contrary evidence. [43][40]

3. 03

   Selective forgetting remains difficult under shared derivatives and delayed ingestion. Canceling work for a deleted target does not cover every content-specific removal. Progress would demonstrate that concurrent publication cannot restore prohibited content while unrelated supported memories remain usable. [48]

4. 04

   Retention policies must adapt to changing usefulness without rewarding frequent reuse of mistaken memories. This matters because recall can reinforce the very information that causes failure. Progress would improve later tasks across shifting needs while measuring harmful reuse, storage growth, and maintenance cost. [7][66]