An AI agent memory retention policy separates temporary session context, user-approved preferences, business records, retrieved knowledge, and learned summaries. Each class needs a purpose, owner, provenance, validation rule, access boundary, expiry, deletion path, and poisoning response.
Tech
Direct answer
AI agent memory should be treated as governed data and an attack surface, not an unlimited convenience. Store only information necessary for a defined purpose, separate authoritative records from generated summaries, attach provenance and expiry, and give users or operators a practical way to inspect, correct, and delete retained state.
Separate five memory classes
Session context supports one interaction or workflow run and normally expires quickly. User-approved preferences persist because a person requested them and should be editable. Business records belong in authoritative systems, not hidden agent memory. Retrieved knowledge is a reference with source and version. Generated summaries or learned memory are derived claims that require the strongest skepticism because they can be incomplete, wrong, or poisoned.
Do not collapse these classes into one vector store. They have different purposes, access rules, deletion requirements, and trust levels. Retrieval should expose the memory’s class, source, creation time, author or process, confidence or validation status, and expiry.
Write the purpose before retention
For every class, name the task it supports and why a shorter lifetime is insufficient. The ICO data minimisation guidance asks whether personal data is adequate, relevant, and limited to what is necessary. Apply that test even when a different jurisdiction governs the deployment.
Avoid retaining full conversations merely because storage is cheap. Extract a user-approved preference when needed, store it separately, and expire the raw context according to the declared purpose. Sensitive stories, credentials, health information, employment details, and third-party data should not become durable memory by accident.
Preserve provenance and authority
Memory is not truth. Mark whether a value came from the user, an administrator, a source system, a document, an agent inference, or another agent. Give authoritative system data precedence. Do not let a generated summary overwrite a verified customer record or policy.
Require validation for memories that can influence tools or consequential decisions. A user may confirm a preference; an operator may approve a workflow fact; a source connector may refresh a record. Unvalidated memory should remain advisory and should not expand permissions.
Defend against poisoning
The OWASP Top 10 for Agentic Applications includes memory and context poisoning. Untrusted content can plant instructions or false facts that persist beyond the original interaction. Separate instructions from data, sanitize retrieved content, restrict which processes can write durable memory, and test whether hostile input can influence later tool use.
Use quarantine and review for unusual memory writes, changes to high-impact preferences, conflicting facts, or content containing operational instructions. Version important memory so investigators can see what changed and restore a prior approved state without deleting evidence.
Set expiry and deletion rules
Define maximum retention and inactivity expiry by class. Refreshing access should not automatically extend retention forever. When a purpose ends, delete or irreversibly de-identify the memory and propagate deletion to indexes, caches, backups according to the documented process and legal requirements.
Deletion must be testable. Maintain a memory inventory, query by user or business key, and verify that the agent no longer retrieves deleted content. Record deletion status without preserving the sensitive content itself.
Control access and use
Use tenant isolation, least privilege, encryption, audit logs, and purpose-bound retrieval. An agent helping with sales should not retrieve HR memory because both belong to the same company. A support agent should not expose one customer’s context to another. Treat memory-export and bulk-search capabilities as high-risk tools.
Provide a human-readable view of retained preferences and relevant derived memories. Let authorized users correct them. Capture the correction as new authoritative evidence and prevent a stale derived summary from reintroducing the old value.
Policy template
Record memory class, purpose, examples, prohibited content, source, authority, writer roles, reader roles, validation, retention, inactivity expiry, deletion trigger, legal hold, encryption, tenant boundary, monitoring, poisoning indicators, incident owner, and test evidence. Review the policy when tools, providers, data sources, or user promises change.
Minimum verification tests
Create a memory, retrieve it only in the intended tenant and task, correct it, expire it, delete it, and prove it no longer influences output or tools. Inject conflicting and malicious content and verify that it cannot become authoritative memory. Revoke a writer role and confirm that durable writes fail. Export the inventory for one user or business record without exposing unrelated tenants.
Repeat these tests after changing the model, embedding system, retrieval logic, provider, or memory schema. A policy is only credible when the deletion and isolation paths work in the running system.
The NIST AI RMF and Generative AI Profile support lifecycle risk management and documentation. They do not prescribe one retention period; the organization must justify periods from purpose, law, contracts, and risk.
Related: AI Agent Audit Log Schema, AI Vendor Due Diligence, and AI Agent Incident Response Plan.
Before production, record the current operating assumptions, named owners, known limitations, review date, and the exact evidence used for approval. That compact decision record helps the next operator distinguish an intentional boundary from an undocumented omission when the workflow or its dependencies change.