Agent Memory

Pathrule1 Rule • 3 Memories • 1 Skill

Agent memory is a governed data lifecycle, not a transcript dumped into a vector index. This bundle separates working, episodic, semantic, and user-authored memory; records provenance and time; enforces tenant access; and makes retention, correction, and forgetting observable. Unlike AI Agents, it focuses on durable memory quality and privacy rather than orchestration, tools, and loop control.

Suggested path map

Pathrule places each piece on the matching path, so your assistant only sees it where it belongs. This is the scoping you get on import; you can adjust it in your workspace.

/ workspace root

audit-agent-memory

src/

ai/

memory/

Authorize memory writes and reads by tenant and subject

Different memory classes have different lifecycles

Every memory carries source, time, and confidence

db/

Forgetting uses tombstones across derived stores

Rules

Authorize memory writes and reads by tenant and subject/src/ai/memoryhighstrictMemory isolation is enforced before storage queries and again before retrieved content enters model context.

1	Memory isolation is enforced before storage queries and again before retrieved content enters model context. A vector similarity match can cross tenants, users, projects, or consent boundaries when authorization is treated as a post-filter. Enforce this boundary in /src/ai/memory so invalid work stops before it reaches another subsystem or creates an externally visible side effect.
2
3	- Partition or filter every write and query with server-derived tenant, subject, workspace, and memory-class identifiers.
4	- Authorize the requested memory class and purpose independently from access to the current conversation.
5	- Recheck each retrieved record before context assembly because indexes and metadata can drift.
6	- Never let model-generated filters, namespaces, or owner IDs override the authenticated scope.
7
8	Verification: Seed near-identical memories across tenants and subjects, corrupt one index label, and attempt model-supplied scope changes; confirm no unauthorized text reaches context.

Memories

Different memory classes have different lifecycles/src/ai/memoryWorking context, episodic events, distilled semantic knowledge, and explicit user preferences differ in authority, retention, update, and retrieval behavior.

1	Working context, episodic events, distilled semantic knowledge, and explicit user preferences differ in authority, retention, update, and retrieval behavior. Give each class its own schema, write trigger, provenance requirement, expiry, correction policy, and ranking signals.
2
3	Do not promote conversation summaries into user-authored preferences or verified facts. Keep ephemeral task state out of durable indexes once the task ends. Require stronger evidence and review for memory that can authorize tools or change high-impact behavior. Keep the decision explicit at /src/ai/memory; moving it into an incidental caller makes behavior depend on which route happened to execute first.
4
5	See /src/ai for context assembly and /src/db for deletion and audit state. That related boundary consumes this decision and carries the evidence that proves it still holds.

Every memory carries source, time, and confidence/src/ai/memoryA fluent statement without provenance is impossible to distinguish from inference, outdated information, or attacker-planted text.

1	A fluent statement without provenance is impossible to distinguish from inference, outdated information, or attacker-planted text. Store the source event or record, observation time, author or producer, memory class, confidence basis, and supersession links.
2
3	Rank current primary evidence above repeated paraphrases of the same source. Expose provenance to the agent so it can qualify uncertain or stale claims. Do not increase confidence merely because the same generated claim appears in several derived summaries. Keep the decision explicit at /src/ai/memory; moving it into an incidental caller makes behavior depend on which route happened to execute first.
4
5	See /src/db for immutable provenance and the agent memory audit skill for quality review. That related boundary consumes this decision and carries the evidence that proves it still holds.

Forgetting uses tombstones across derived stores/src/dbDeleting the canonical row is insufficient when embeddings, summaries, caches, exports, and backups can continue returning or recreating the memory.

1	Deleting the canonical row is insufficient when embeddings, summaries, caches, exports, and backups can continue returning or recreating the memory. Create a durable deletion or supersession record keyed to every derived artifact and block retrieval immediately.
2
3	Remove active copies asynchronously with idempotent jobs and retain only the minimum non-content evidence needed to prevent re-import. Reapply tombstones after index rebuilds and backup restoration before serving queries. Distinguish user correction, expiry, policy deletion, and source retraction so future ingestion behaves correctly. Keep the decision explicit at /src/db; moving it into an incidental caller makes behavior depend on which route happened to execute first.
4
5	See /src/ai/memory for retrieval filtering and /src/ai for context invalidation. That related boundary consumes this decision and carries the evidence that proves it still holds.

Skills

audit-agent-memory/rootAudit agent memory for provenance, isolation, freshness, contradiction, retrieval quality, and deletion behavior.

1	---
2	name: audit-agent-memory
3	description: Audit agent memory for provenance, isolation, freshness, contradiction, retrieval quality, and deletion behavior.
4	---
5
6	# Audit Agent Memory
7
8	Run this procedure whenever the governed surface changes or its operational evidence becomes stale.
9
10	1. Sample each memory class and trace records to source, subject, tenant, observation time, confidence basis, retention, and supersession state.
11	2. Run retrieval tests with authorized, unauthorized, stale, contradictory, corrected, and adversarially similar memories across tenants.
12	3. Inspect context assembly for provenance visibility, token budgeting, duplicate evidence, and instructions embedded inside remembered content.
13	4. Delete and correct seeded memories, rebuild the index, and restore a test backup; confirm tombstones prevent every active and regenerated copy.
14
15	Record the decision, failed checks, and follow-up owner with the change. A successful run leaves reproducible evidence that another reviewer can inspect without repeating the investigation from memory.

Why this pattern

Agents save untrusted conversation text as fact, mix tenants in retrieval, ignore contradictions and time, and provide no reliable way to correct or forget memory.

Built for Teams building assistants or agents that retain information across sessions and users.

Keeps your assistant from:

Conversation claims promoted to durable truth without provenance
Cross-tenant memory retrieval and disclosure
Stale or corrected facts continuing to steer future actions

View as markdown

License: Apache-2.0
Version: 1.0.0
Updated: 2026-08-25