How it works
Memory hygiene treats agent memory as an engineered state surface, not as a convenient place to store everything the model noticed. The harness decides which observations are eligible for persistence, which fields are authoritative, how long they remain active, and when they can influence later behavior.
A practical memory hygiene loop usually has five parts:
- Capture: record candidate memories with source, time, actor, task, and confidence.
- Classify: separate durable facts, temporary working context, preferences, credentials, hypotheses, and model-generated summaries.
- Admit: persist only entries that pass a policy gate, schema check, or review requirement.
- Apply: retrieve memory through scoped context assembly rather than dumping the whole store into every run.
- Retire: expire, supersede, quarantine, or delete memory when it becomes stale, disputed, irrelevant, or unsafe.
The important detail is that memory is not just data. It is future influence. A bad memory can alter prompts, tool choices, permissions, priorities, and evaluations. Hygiene therefore requires both storage rules and use rules. Provenance without retrieval control is weak. Retrieval control without provenance is hard to debug. The two belong together.
Why it matters in an agent harness
Agent memory gives continuity to work that would otherwise restart from zero. It can preserve project constraints, operator preferences, domain facts, known failures, account-specific conventions, and pending obligations. That continuity is valuable. It is also a route for contamination.
In a harness, the memory layer sits close to control. If an agent stores an incorrect instruction as a preference, later runs may treat that mistake as standing authority. If it saves an unverified claim as a fact, future drafts or decisions may propagate it with more confidence than it deserves. If it persists sensitive data outside the right boundary, a later tool call may expose it in a broader context. If it never forgets, old decisions keep voting after the operating conditions have changed.
Good memory hygiene improves reliability because it limits the distance between evidence and action. A future run can ask: where did this memory come from, when was it observed, who or what approved it, what scope may use it, and what should override it. Those answers make behavior legible.
It also improves reversibility. If memory entries are typed, versioned, and linked to the runs that created them, the harness can retract a polluted memory without discarding the whole workspace. If memory is mixed into opaque summaries, rollback becomes guesswork.
The permission angle is just as important. A memory should not smuggle authority across tasks. Remembering that an operator approved one payment, deploy, or data export is not the same as having standing permission for similar actions. The harness needs to distinguish descriptive memory from delegated authority. That boundary prevents convenience from becoming privilege creep.
Memory hygiene vs context management
The distinction matters because the controls live in different places.
| Concept | Main question | Harness control |
|---|---|---|
| Memory hygiene | What saved state is allowed to persist and influence later work? | Admission policy, provenance, expiry, correction, quarantine |
| Context management | What information should be assembled for this specific run or step? | Retrieval scope, ranking, compaction, prompt layout, token budget |
Context management can make a run cleaner without fixing bad stored state. Memory hygiene can make the store safer without guaranteeing that the right context is assembled for a task. Mature harnesses need both. I would treat memory hygiene as the upstream integrity layer and context management as the downstream selection layer.
One design consequence follows: do not rely on prompt wording to clean memory at use time. If the memory store contains unscoped instructions, stale facts, or mixed-confidence summaries, context assembly becomes a repeated negotiation with bad inputs. The better control is to prevent, label, or retire those entries before they become ambient context.
The Rifty take
We optimize for memory that can be inspected, challenged, and changed. A harness should remember enough to make work continuous, but not so much that yesterday's trace becomes tomorrow's hidden policy.
The tradeoff is friction. Some candidate memories need schemas, expiry, review, or rejection. We accept that cost because persistent influence is a control surface. Convenience is not a sufficient reason to make state durable.
Common failure modes
- Saving model summaries as authoritative facts without linking them to source evidence.
- Treating a one-time approval, exception, or workaround as a permanent operator preference.
- Allowing tool outputs, retrieved pages, or external instructions to write directly into durable memory.
- Mixing personal preferences, project facts, credentials, and task-local notes in one undifferentiated store.
- Retrieving all memories for every run, which turns persistence into ambient prompt pollution.
- Failing to expire time-sensitive facts such as prices, policies, schedules, account state, or dependency behavior.
- Compacting memory until uncertainty, dissent, and provenance disappear.
- Lacking a quarantine path for memories that may be useful but are not yet trusted.
- Making deletion possible in storage but impossible in practice because downstream summaries copied the same claim.
- Measuring memory only by recall quality, not by correction quality, containment, and recovery after a bad write.
Frequently asked questions
What should an agent be allowed to remember?
An agent should remember durable, scoped information that improves future work and can be traced back to an acceptable source. That usually includes stable project constraints, operator-stated preferences, confirmed facts, and known failure lessons. Temporary observations, unverified claims, and task-local reasoning should expire unless a policy admits them.
How is memory hygiene different from deleting old context?
Memory hygiene is broader than deletion. Deletion is one retirement action. Hygiene also covers admission, provenance, typing, scope, expiry, correction, and retrieval. A harness can keep old memory safely if it is labeled, bounded, and superseded correctly. The failure is uncontrolled influence, not age alone.
Why is provenance necessary for agent memory?
Provenance makes memory debuggable and reversible. When a later run acts on a saved fact or preference, the harness needs to know where it came from, when it was captured, and what authority it carried. Without that trail, correcting polluted memory becomes a manual archaeology problem.
Can agent memory create a security problem?
Yes. Memory can carry sensitive data, external instructions, or implied permissions into later tasks. The risk is not only disclosure. A stored instruction can become a confused deputy path if a later agent treats it as operator authority. Memory therefore needs permission scope, write controls, and retrieval boundaries.
What is a good test for memory hygiene?
A good test is to inject a plausible but wrong memory, then verify containment and recovery. The harness should show where the entry came from, limit where it is retrieved, prevent it from overriding higher authority, allow correction or quarantine, and leave an audit trail of the change.