Skip to content

Chapter 3.6 — Memory in agentic systems

🎯 Objective

Distinguish prompt history from persisted memory — and treat memory as a system with governance.

🧠 Types of memory

Type Stores Typical store Risk
Short-term Recent history Runtime, Redis Context overflow
Working Plan, hypotheses, artifacts Runtime, checkpoints Exposing sensitive reasoning
Long-term Preferences, facts SQL, document, vector Privacy, obsolescence
Episodic Executions and feedback Event store, logs Reusing an old error
Semantic Stable knowledge Document, KG Bad governance
Operational Workflow state Temporal, DB Inconsistency
Tools Result cache Cache, KV Stale cache
Decisions Who decided what and why Audit log Lack of explainability

🛡️ Principles

  • Mandatory segmentation — by user, tenant, workspace, region, classification, purpose.
  • Explicit expiration — TTL per type.
  • Consent when applicable.
  • Auditing of reads and writes.
  • Memorize confirmed facts; do not memorize the model's guesses.

🚨 Memory poisoning

Occurs when incorrect, malicious or ambiguous data is persisted and reused.

Mitigations:

  • classify the type (fact vs inference);
  • record the source (provenance);
  • require confirmation for persistent preferences;
  • apply TTL;
  • validate against sources of truth;
  • allow editing/deletion;
  • use evals for memory.

📚 References