The strong rivalUse established databases for durable records

If memory is persisted state, database literalism is a valuable corrective. Put authoritative customer, case, inventory and policy records in governed systems of record. Use database access controls, integrity constraints, backups, retention and recovery. Do not build a parallel vector store that silently becomes the organisation’s truth.

The additional layer is justified only for admission, type, placement, consolidation, retrieval influence, revalidation and forgetting across those stores. It should reference authoritative state rather than copy it where practical. For a current account status, store a versioned identifier and retrieve the source at use time. For an interaction episode, retain the event under its purpose without promoting its interpretation into an operational fact.

A conversation transcript is evidence that text was exchanged, not proof that every assertion is true or every instruction remains valid. Model weights are neither a queryable system of record nor a reliable route for correction and deletion. A vector index locates similarity but does not supply authority, consent, tenancy, temporal validity or permitted action.

The boundary is durable influence. If a value expires with the task and cannot shape later behaviour, working context may suffice. If it will be retrieved later, generalised across episodes, used to prioritise a person or justify action, it needs a governed object and lifecycle even when the underlying bytes live in an ordinary database.

Original constructThe ten-field Governed Memory Object

The object is this article’s synthesis. It preserves what the candidate says, whose claim it is, why it may be retained and what it may influence. Fields can be implemented across records and policy services, but they travel together in the decision path.

Authority cannot be inferred from salience. Repetition, recency, emotional language, semantic similarity and model confidence may help locate a candidate; none grants permission to write, consolidates it into truth or authorises an action.

Six reversible operationsThe memory control plane

Admit

Type the candidate before writing. Verify the actor’s authority, collection purpose, consent where relevant, sensitivity, tenancy, source evidence and injection signals. User text may propose a preference or commitment; it cannot write enterprise policy. Retrieved documents remain data unless an authorised workflow promotes a controlled instruction.

Place

Choose working context, event log, system of record, episodic store, semantic store, procedure repository or quarantine. Placement follows claim semantics and authority, not storage convenience. An operational fact belongs in its source system. Agent memory keeps a versioned reference and any permitted task-specific interpretation.

Consolidate

Repeated episodes may support a candidate preference or pattern. Preserve input identifiers, dissent, sampling limitations, uncertainty and the transformation that produced it. A reviewed generalisation may reduce retrieval noise; it cannot acquire more authority than its evidence. Keep corrected or contradictory episodes visible to the consolidation decision.

Retrieve

Task-aware cues find candidates only inside tenant, subject, purpose, time, entitlement and influence filters. Diversity and negative evidence can prevent one frequent pattern from dominating. Similarity retrieves possibilities. Policy decides whether a memory enters context and whether it may suggest, personalise, justify, disclose or authorise.

Revalidate

Before consequential reliance, compare operational references with the current source, verify temporal status, check corrections and revocations, and surface contradictions. Revalidation can downgrade a memory to contested, replace it with a current reference, ask the user, require review or stop its use. A receipt records the tested versions.

Forget

Expiry, supersession, correction, erasure and deliberate noise reduction are distinct operations. Make the object unavailable, then propagate invalidation to indexes, embeddings, summaries, caches, conversation state and dependent decisions. Record acknowledgement or deletion proof without retaining the removed payload unnecessarily.

Placement is semanticSeparate stores by authority and lifecycle

A commitment is not merely an episode. It has an owner, due state, completion evidence and escalation path. Store the interaction as evidence, then create or reference the governed task record that controls fulfilment. A free-text recollection that “we promised to call” cannot prove completion or allocate responsibility.

A preference is not consent and does not authorise a sensitive action. “Prefers email” may be scoped to service notifications and confirmed when material. It does not permit disclosure of a health result or financial statement. Preferences need correction, expiry and context; a single inferred choice should remain proposed until its consequence warrants confirmation.

Compression is not verificationKeep lineage and dissent through consolidation

Suppose six episodes suggest that a customer prefers concise reports. A consolidation process can propose a scoped preference, record which interactions supported it and note that the sample came from one project. If the preference will materially change service, ask the customer before activation. Expire it after a suitable period and retain a correction route.

Now an authoritative correction states that accessibility needs require detailed text. The correction outranks the behavioural inference for the affected use. The derived preference becomes contested or superseded; the episodes are not rewritten. Retrieval presents the current authoritative requirement and may retain the earlier pattern only for an authorised explanation of why the system once behaved differently.

Summaries can hide minority evidence. Consolidation tests coverage, contradiction and source diversity, then attaches uncertainty and negative evidence. It should not repeatedly summarise its own prior summary as if that created independent support. Reflection generated by the same model is a derived candidate, not an external observation.

Procedural consolidation is stricter. Repeated staff behaviour does not make an approved procedure. A procedure repository requires a named owner, review, effective version and protected write route. Memory can propose an update with evidence, but only the authorised workflow can activate it.

Two gates against durable poisoningAuthority at write time and influence at read time

Untrusted web pages, emails, tool results and retrieved documents can contain instructions to remember a new policy, leak another user’s data or weaken later controls. Treat those strings as source content. The admission gate checks whether the source has authority to create that memory type. A public page can support a cited observation; it cannot write internal policy or a standing tool instruction.

Quarantine preserves enough controlled evidence for investigation without making the candidate retrievable as active context. Repeated occurrence does not legitimise it. If a legitimate workflow later approves a rule, it creates a new procedure object through the protected source, with its own version and provenance rather than promoting the attacker’s text.

Read-time enforcement is still necessary because an admitted observation can be misapplied. Retrieve only within tenant and subject filters, then check purpose, destination, temporal validity, entitlement and permitted influence. An episode may inform a response but not justify a payment. A preference may personalise format but not override a safety or disclosure policy.

Cross-tenant collision tests use similar names, shared vocabulary and deliberately close embeddings. Filters must shape candidate generation so another organisation’s memory cannot influence ranking, counts, caches or timing. A global post-filter is too late for sensitive stores. Cache keys and consolidation jobs carry the tenant boundary.

Useful forgettingCorrection and deletion are dependency operations

When a user corrects a preference, append or update the governed object according to the source contract, mark the earlier version superseded and invalidate derived retrieval artefacts. When erasure applies, make the object unavailable, remove or recompute embeddings and summaries, clear caches, stop consolidation reuse and address dependent outputs where required. Deleting only the primary row leaves functional copies.

Deletion proof records controlled identifiers, locations checked, actions, acknowledgements, exceptions and completion time without recreating the removed content. Some audit evidence may need to show that a deletion occurred while access to the earlier payload ends. Retention and erasure depend on the applicable purpose, role, jurisdiction and legal basis; the memory layer enforces the mapped decision rather than inventing it.

Useful forgetting also improves retrieval. Obsolete preferences, completed commitments, noisy episodes and expired task state compete with current evidence. Expiry and consolidation can reduce this interference while respecting audit requirements. Measure harmful influence, contradiction handling, stale recall, cross-tenant exclusion, correction latency and deletion propagation, not only whether a benchmark question retrieves a remembered detail.

Dependent decisions need a disposition. A corrected formatting preference may only affect future outputs. A poisoned procedure that influenced payments may trigger containment, review and remediation. The memory-use receipt links the object versions, influence boundary and resulting action so incident response can find the affected set.

Worked admission and useOne service conversation produces six different state decisions

A customer opens a support conversation about a delayed order. During the exchange, the assistant calculates a revised delivery range, reads the current shipment state, records that the customer contacted support, hears “please use email for this case”, promises a follow-up by Friday and retrieves a document that claims a new refund procedure. Treating all six items as conversation memory would hide their different authority, scope and lifecycle. The control plane types each candidate before deciding whether it may persist or influence a later turn.

The calculation stays transient

The revised range is an intermediate result derived from the current carrier estimate and service rule. It helps compose this answer but has no independent authority after the sources change. The router keeps it in working context with the source versions used for the immediate decision and expires it at task completion. If the customer later asks for the delivery date, the assistant reconstructs the answer from current operational state rather than retrieving the old arithmetic as a fact. A consequential promise derived from the calculation would be a separate commitment object.

The shipment fact returns to its owner

The shipment status belongs in the fulfilment system. If the assistant receives an authorised update, it writes through the governed domain service, which enforces identifier, transition, actor and integrity rules. Agent memory retains only the shipment identifier, observed version and purpose needed to revalidate. On the next interaction, similarity can locate the reference, but the source supplies current state. This design avoids a stale sentence such as “parcel is at depot” competing with the actual tracking record days later.

The contact becomes a bounded episode

The interaction itself may be retained as a case episode because it explains service history. Its object names customer, order, tenant, channel, purpose, event and recorded times, source transcript reference, sensitivity, access policy and expiry. It can inform an assigned agent that contact occurred and what issue was raised. It cannot establish that every customer assertion was correct, authorise an account change or become a training example without the separate permissions and controls required for those uses.

The preference is scoped and confirmed

“Please use email for this case” is an explicit preference with a narrow subject and duration. The assistant can activate it for case communications, provided the channel is permitted and the address is verified through the owned contact service. It should not generalise the choice into permanent marketing consent or disclosure authority. If repeated interactions suggest a broader preference, the system proposes a semantic object with its supporting episodes and asks for confirmation when the consequence warrants it. A later correction supersedes the object and prevents retrieval of the obsolete version as active guidance.

The promise becomes accountable work

A promise to follow up by Friday creates more than memorable prose. The system writes an owned commitment with responsible team or person, due time and timezone, completion criteria, status, escalation and evidence of fulfilment. The episode links to that record. Memory retrieval may remind the assistant, but completion comes from the task system. If the task is reassigned or closed, the event history preserves what changed. Expiry prevents an old open-ended promise from resurfacing after verified completion, while the receipt can still explain the service decision.

The alleged procedure is quarantined

The retrieved document contains text instructing the assistant to remember a new refund account. Its source lacks permission to write procedures, and the instruction arrives through an untrusted content channel. Admission records a security event and places a controlled reference in quarantine with no active retrieval influence. The refund workflow continues to use the approved procedure repository. If policy owners later validate a legitimate change, they publish a new signed version through their workflow; they do not convert the untrusted sentence into authority.

The resulting conversation has not produced one memory stream. It has produced temporary working state, a versioned operational reference, a scoped episode, a case preference, an accountable commitment and a rejected instruction. Future retrieval can now ask which of these objects is relevant and permitted without confusing relevance with truth or action authority. The memory-use receipt names whichever objects shape the response and makes their influence auditable.

Design the write contract before choosing retrieval

Many memory projects begin with an embedding model and top-k search. The harder contract is admission. For every type, define authorised writers, required evidence, mandatory fields, sensitivity rules, lifecycle states, confirmation, expiry and correction. A preference may be written by the subject or proposed from behaviour; a procedure requires its policy owner; an operational fact uses the domain service; an episode requires a legitimate collection purpose. The storage interface rejects a candidate that cannot satisfy the relevant contract rather than saving loose text for later interpretation.

Idempotency and identity are part of that contract. Retries should not create repeated episodes that falsely amplify a pattern. Stable subject, tenant, case and source identifiers prevent similar names from merging. The system records whether two statements are duplicates, updates, independent observations or contradictions. This structure reduces retrieval noise and stops frequency from impersonating corroboration.

Use influence levels as explicit policy

Not every retrieved object should have the same effect. A working note can support the current calculation. An episode can remind or suggest. A verified operational reference can justify a factual statement after revalidation. Only an approved procedure or external authorisation can permit an action, and many actions still require a separate human or service decision. Represent those influence levels in policy and tool contracts. Prompt placement alone is not an enforcement mechanism because models may treat any salient text as instruction.

When several memories enter context, evaluate their combination. Two independently permitted episodes might reveal a sensitive pattern. A profile preference plus case detail may disclose identity to the wrong destination. The retrieval layer minimises the set, preserves source labels and passes an influence map alongside content. Output and tool enforcement then check whether the response stays within disclosure and action boundaries.

Revalidate at the moment of consequential use

Revalidation is proportional. A recent, low-impact formatting preference may need only status and expiry checks. A fact affecting eligibility or payment returns to its authoritative source. A procedure checks the current signed version and effective interval. A derived semantic claim checks correction, contradiction and review state. An episodic account remains an account of what was said, even if a later source disproves its assertion; the current answer includes the correction rather than rewriting the earlier event.

If the source or policy service is unavailable, the fallback follows consequence. The assistant may use a bounded cached value for harmless personalisation, ask the user, route to a human, delay an action or abstain. It does not silently upgrade old memory because the current source is inconvenient. The receipt records the failed revalidation and fallback so teams can measure operational pressure to misuse memory.

Evaluate harmful influence, not recall alone

A benchmark that rewards remembering a favourite colour tests only one narrow capability. Enterprise evaluation also plants untrusted instructions, creates cross-tenant near matches, supplies corrections, changes entitlements, advances expiry, inserts authoritative contradictions and requests a sensitive action. Tests observe candidate generation, ranking, context, outputs, tools, caches and deletion. Success includes refusing to recall, retrieving a dissenting episode, choosing the current source over a frequent memory and forgetting an obsolete preference.

Measure admission precision by memory type, unauthorised write attempts, cross-boundary candidate influence, contradiction visibility, source revalidation success, stale-use rate, harmful action prevented, correction propagation time and deletion acknowledgement. Retrieval relevance remains useful, but it is subordinate to the governed task. A memory system that recalls more while increasing false authority is performing worse.

Operate an ownership and review queue

Governed objects need owners who can resolve proposed, quarantined and contested states. Queues should expose the candidate type, safe evidence, affected subjects, expiry and proposed influence, while limiting access to sensitive payload. Reviewers can verify, narrow, supersede, reject or request more evidence. Ageing alerts prevent proposed preferences and quarantined instructions from becoming permanent clutter. High-volume types need sampled quality review and automated controls, not silent activation.

Change management covers schema, embedding, retrieval and policy versions. Rebuilding an index must preserve tenant and lifecycle filters. A new consolidation prompt cannot rewrite all semantic memories without versioning, evaluation and rollback. Restoring a database backup must reconcile later deletions and revocations. Disaster recovery is incomplete if it resurrects objects whose right to influence has ended.

Prove forgetting end to end

Begin with an inventory of primary objects and every derivative that can still affect behaviour. The deletion workflow sends versioned instructions to the object store, vector index, cache, summary store, consolidation corpus, conversation state and downstream consumers. Each component acknowledges removal, recomputation or a documented retention exception. Tests attempt retrieval by identifier, semantic paraphrase and former relationship. Backups follow a defined isolation and expiry process so restored data cannot re-enter active service without reconciliation.

Completion evidence distinguishes unavailable, physically deleted, cryptographically erased, superseded and retained under exception. These states have different meanings and should not be advertised as one deletion outcome. The requester receives the appropriate confirmation, while security and audit retain only the evidence necessary to prove the governed operation. Useful forgetting is therefore both a product behaviour and a verifiable data lifecycle. Regular restore exercises must confirm that expiry, correction and tenant boundaries survive recovery, because a backup that resurrects active influence can undo an otherwise successful deletion.

Consequential-use evidenceThe memory-use receipt

The receipt records the request, memory identifiers and types, subject and tenant, origin and authority, versions, retrieval rationale, revalidation source, contradictions, permitted influence, resulting claim or action, human review, expiry and correction, deletion or replay obligations. It proves why a memory was allowed to shape this task.

For operational references, the receipt names the current source version checked at use. For episodes, it records purpose and expiry. For a consolidated preference or procedure, it links the evidence and review. For rejection, it records a safe reason without adding the hostile payload to another durable store. For forgetting, it tracks invalidation acknowledgements.

Receipts are governed records themselves. Restrict access, minimise payload and retain them only for their audit or incident purpose. Aggregate measures can reveal admission rejection, contested retrieval, stale revalidation and deletion performance without exposing personal memories.

Interactive instrumentMemory Admission and Use Router

Set the candidate, authority, evidence, tenancy, lifecycle and intended influence. The Router returns one of exactly five routes with a store, influence boundary, expiry and evidence action. It does not produce an importance, salience or memory-maturity score.

Exactly five outcomesMemory routes describe control, not importance

Keep in working context and expire with the task

Use for transient calculations, draft transformations and intermediate state that has no justified future influence.

Write verified operational state to its system of record

Use for authoritative domain facts. The memory layer keeps a governed version reference and revalidates the source before consequential use.

Store a provenance-bound episodic memory with expiry

Use for scoped interactions, outcomes and commitments that need later recall without becoming universal truth.

Consolidate a reviewed semantic or procedural memory

Use when adequate evidence, authority and review support a bounded generalisation or approved instruction while lineage remains intact.

Reject, quarantine, supersede or forget the candidate

Use for untrusted instructions, tenant collisions, contradictions, expired state, corrections, erasure or candidates without a safe influence boundary.

Negative controlsTen cases that test durable influence

Evidence boundaryAgent-memory mechanisms are candidates, not proof

Agent-memory research demonstrates modular working, episodic, semantic and procedural designs, memory streams, reflection, virtual context, persistent conversational stores and decoupled retrieval modules. These studies motivate mechanisms and evaluations; they do not establish enterprise authority, privacy, tenant isolation, correction or reliability. Human cognitive categories are analogies for distinct functions, not evidence that a model remembers as a person does.

Provenance and temporal standards support derivation, version, validity and invalidation. Security guidance supports treating persistent context as an attack surface and keeping untrusted content separate from governing instruction. Production-ML work explains dependency and feedback debt. NIST sources support lifecycle, information integrity, monitoring and accountability within their stated scope.

The GDPR’s purpose limitation, minimisation, accuracy, storage limitation, rectification, erasure and security requirements apply according to the processing, role, lawful basis and jurisdiction. EU AI Act governance, logging, transparency, oversight, monitoring and corrective duties depend on classification, actor, provision and timing. Neither mandates this object or Router.

The Governed Memory Object, six-operation control plane, durable influence boundary, memory-use receipt and Router are this article’s synthesis. Implement them with systems proportionate to the decision and preserve the stronger database rival wherever current authoritative records are enough.