For weeks our own canon carried a note saying that a particular endpoint was a useless dead end. An agent had tried it, failed, and written down what it found. Then someone ran against that endpoint for real, and it worked. It had probably worked for a while. Nothing had raised an error in the meantime, because nothing had been violated. That is the failure class AI agent memory introduces and that a single session cannot produce: acting on something that was accurate the day it was recorded and is not accurate now.
The note was not sloppy. It was written carefully, by an agent that had genuinely observed what it described, at a moment when the description was correct. Every property we would have used to judge it was intact.
What we thought the risk was
We had been guarding against bad writes: junk in, junk out, and the fix is to be stricter about what gets recorded. So we worried about an agent inventing a detail and then believing itself later.
That risk is real and it is also the harmless half. An obviously wrong note gets rejected on sight, by a reviewer or by the next step that tries to use it. It fails early and it fails loudly. We were watching the half of the problem that announces itself.
Why stale but true is worse than wrong
A claim that was correct three months ago passes every inspection a reader can perform. It has the right shape, a plausible value, a complete set of fields. It was constructed correctly. It simply describes a world that has since moved. Correctness of form is not evidence of currency, and form is the only thing visible at read time.
Nothing in the pipeline objects, either. Retrieval worked, the note parsed, no contract was broken. And there is no owner sending an invalidation: the endpoint did not notify anyone that it had started working. That is what separates a memory layer from a cache. A cache has something upstream that knows when it went bad. A store of recalled claims has nobody, so a fresh assertion and an old one are indistinguishable unless the store made the difference legible when it wrote the claim down.
Claims in AI agent memory do not rot at the same speed
Some claims change only when a person deliberately changes them. Others drift on their own, silently, with no event anyone will ever send you — those are the ones that go bad while looking untouched. A third kind was never observed at all; it was concluded from something else, and it inherits the age of that something without recording it.
The useful move is not longer retention or shorter retention. It is that each claim carries an expectation of how fast that particular kind of claim rots, fixed when it is stored, so age can be judged against something rather than against a feeling. Age is the only detector available, because nothing about the content will ever look wrong.
Some things should never be written down at all
The other half of the discipline is refusal. Some categories must never reach the store at all, and they are refusable at the door rather than cleaned up afterwards.
- Secrets. AI agent memory is built to survive and to be read widely. Both properties are exactly wrong for a key. Record where the secret lives, never the secret.
- Anything that expires by itself. Signed links, session identifiers, one-time codes, “rate-limited until”. These are guaranteed to be false later and carry no signal that they became false. They are not facts, they are weather.
- Inferences wearing the clothes of observations. “The team prefers short reviews” is a conclusion. What was observed was that a few reviews got split. Written in the voice of evidence, an inference becomes evidence to every session that reads it afterwards.
The write that returned OK and landed nowhere
One more failure is undetectable later and worth naming separately: a write that reports success and does not land. A loud failure is a nuisance. This one produces no error when the claim is next needed, because an absence does not look like anything. The session simply does not know something, behaves exactly as though it never learned it, and gives no sign that a record was lost. The only thing that catches it is reading the claim back through the ordinary read path and comparing the bytes — not the write’s own status, which is answering a different question.
What we take from it
The principle is short: memory without provenance is not memory, it is an assertion with no address. A claim that cannot say where it came from cannot be re-tested, so it can never be retired, so it will be believed forever. And in AI agent memory the danger scales with usefulness — the store nobody consults is harmless whatever it holds, while the load-bearing one is precisely where a single unchecked claim reaches a live action. Age the entries hardest where the agent trusts them most.
The runnable procedure — the required field set, the refusal tests in the write path, the read-back comparison and the sweep that measures a store’s real decay rate — lives in the member library.
How we know
Grounded in: our own canon carrying a note for weeks that a named endpoint was an unusable dead end, until a run against that endpoint in September 2026 succeeded. Verified: the endpoint answered normally when actually called, while the stored claim remained well-formed, complete and unchallenged by any error. The runnable procedure lives in the member library.
Leave a Reply