Memory Has to Survive a Revoke Test

Vector recall over prior conversation can make an assistant feel continuous, but it does not answer who owns a fact, which agent may see it, why access was granted, or how access ends. Production memory begins where those questions become enforceable. In a household product, a request to remember something is often followed by a request to forget it, including a request that the other agent not be told.

A working architecture separates facts, ownership scope, explicit share grants, access logs, and outcome feedback. Collapsing them into one embedding record makes retrieval simple while making revocation and audit ambiguous. If you cannot point to the grant, you do not have sharing. You have leakage with a similarity score.

The strongest test is behavioral. Create a fact, share it with another agent, retrieve it, revoke the grant during the same session, and require the next message to behave as though the fact is unavailable. A delayed cleanup job does not satisfy that contract. Overnight tombstoning is how secrets survive the conversation that tried to withdraw them.

The test should cover every retrieval path, including background consolidation, scheduled summaries, and administrative search. Two retrieval implementations imply two security models unless both consume the same authorization decision. The interactive path is usually the one that was remembered in the design.

Consolidation, confidence decay, archival, deduplication, and insight generation all decide which facts remain visible or influential. A job that merges facts across owners can widen access even when the interactive retrieval path is correct.

Each job therefore needs explicit scope inputs, an access-log entry for protected reads, and a regression test for revocation. Treating background work as harmless maintenance is how policy leaks enter systems whose foreground tools appear well governed.

The addition of grants, logs, and revocation did not produce a defensible measured increase in answer quality. It increased storage, test surface, and operational cost. The direct value was a set of governance properties: access could be explained, withdrawn, and audited.

That boundary prevents a common category error. Memory should not be justified with a vague claim that an agent became smarter. It should be justified by the recurring work it improves or the governance risk it controls, with those outcomes measured separately. If the only pitch is that the system remembers, the product being sold is a longer prompt.