Agent Memory Boundaries

A shared workflow does not justify a shared unlimited memory. A triage agent may need temporary issue context while a billing agent needs only a minimal account reference. If both agents can read and write one persistent namespace forever, the system has silently widened purpose, access and retention.

The lesson artifact is Agent Memory Boundary & Retention Matrix v1. Its job is to make memory class, owner, purpose, provenance, read/write/share scope, retention, clear/deletion behavior and review status reproducible from visible evidence.

First rule: participation in the same workflow is not authority to read, write or retain the same memory.

Route orientation and owned boundary

AGN-005 owns memory boundaries. AGN-004 owns agent authority; AGN-006 owns failure/retry/reconciliation. This lesson can reference authority or a clear event, but it does not grant standing authority or define retry behavior.

Foundation learners use the field map and baseline. Experienced learners may skip definitions, but they must pass the same purpose, provenance, share, retention and sensitive-trace gates.

Mental model: memory is a family of bounded stores

Keep these classes separate:

1. Run context — ephemeral data available inside one run.
2. Session history — conversational items attached to a session.
3. Durable memory — retained lessons/preferences intended to survive later runs.
4. External resource reference — a pointer to governed data elsewhere, not a copy of everything it can reach.
5. Trace data — observability records that may independently contain sensitive inputs/outputs.

For every class ask: who owns it, why it exists, which agent may read/write it, whether cross-agent sharing is allowed, how provenance is preserved, when it expires or clears, and who reviews exceptions.

Foundations: current FACT versus local DESIGN

Current OpenAI Agents SDK Sessions store conversation history for a session and expose get/add/pop/clear operations. Sandbox agent memory is documented separately from conversational Session memory; its reuse and isolation can depend on a stable conversation identifier and memory layout. Tracing can contain sensitive generation or function inputs/outputs, and the SDK provides a control for omitting sensitive trace payloads.

Those are mechanism facts. MAKNOW's exact memory classes, retention periods, share gates, authority references and review states are local design choices.

Deep explanation of the matrix

The critical contract has 21 dimensions: memory_id, memory_class, owner_id, agent_id, purpose_id, data_class, source_ref, provenance_ref, read_scope, write_scope, cross_agent_share, session_conversation_ref, retention_rule_ref, expires_at, clear_trigger, deletion_state, compaction_state, sensitive_trace_capture, authority_ref, status, and review_owner.

Important gates:

• Cross-agent access is not inferred from workflow membership.
• A durable model inference needs provenance before it is promoted into retained memory.
• Indefinite retention requires an explicit governed authority; convenience is not a retention basis.
• Expired or deleted memory cannot remain ACTIVE.
• Clearing session history does not automatically erase a separate sensitive trace copy.
• Compaction must not erase provenance needed to reconstruct why retained memory exists.
• Unknown or prohibited memory must stay typed as absent/restricted/hold rather than silently widening context.

Worked examples

1. Bounded triage session

A synthetic support session stores issue history for the triage agent only. Purpose is issue triage, sharing is false, retention is 24 hours or case closure, and a named owner reviews the rule. The bounded result is active session history.

2. Invalid shortcut: one durable shared memory

A developer proposes a durable namespace readable by triage and billing forever, then writes a model-generated summary with no provenance. Multiple gates fail: share authority, retention authority and durable-inference provenance.

3. Transfer: fraud reviewer asks for prior history

A new fraud-review agent joins the workflow. Do not copy full history merely because it is now “part of the team.” Recompute purpose, data class, read scope, cross-agent sharing and retention. A restricted result can be correct even when the baseline was active.

Failure modes

• One-store collapse: treating run context, session history, durable memory, resources and traces as equivalent.
• Workflow-membership authority: granting another agent history access because it joins the workflow.
• Retention by convenience: changing a session-bound record to forever with no new purpose or authority.
• Inference promotion: writing model inference into durable memory without provenance.
• Clear fiction: clearing session history while a sensitive trace copy remains outside the declared boundary.
• Expired-active state: leaving expired/deleted memory readable because a store still contains bytes.
• Compaction amnesia: summarizing retained memory while losing provenance.
• Baseline oracle: copying a previous share decision after agent, purpose or data class changes.

Alternatives and trade-offs

Short-lived context minimizes retention risk but may increase repeated work. Durable memory can reduce repeated explanation but requires stronger provenance, owner and deletion controls. External references avoid copies but still need authorization at read time. Tracing improves debugging but can create a separate sensitive-data surface. Cross-agent sharing may reduce duplication, yet it widens exposure and must be purpose-bound.

Experienced bridge

For an experienced engineer, answer six questions:

1. What exact memory/data class is this?
2. Who owns it and for what purpose?
3. Which agent may read and write it?
4. What provenance supports retained content?
5. What event expires, clears or deletes it?
6. Which separate copies—especially traces—survive that event?

Any unknown answer blocks an automatic widening of context.

Guided and independent practice

Inspect derived_text/tables/AGN-005-T1.csv, then run:

python -B lab/AGN-005-LAB1/learner/run_checks.py

For independent practice, create one session-bound record, one durable inferred record, one trace record and one cross-agent request. Keep each class and lifecycle independent.

Verification evidence

Passing evidence is a reproducible matrix, not a screenshot of a memory UI. The lab must reject indefinite retention without authority, cross-agent reads with sharing disabled, untraced durable inference, active expired/deleted memory, sensitive trace copies outside a clear boundary, and transfer that reuses the baseline decision.

No hidden model reasoning is needed to reproduce the result.

Assessment and transfer

Assessment covers boundary retrieval, baseline application, mutation diagnosis and changed-context transfer. In transfer, a fraud-review agent requests prior conversation history. Recompute from purpose, data class, share authority and retention. Do not treat same-workflow membership as permission.

Copying the baseline full-history decision fails transfer.

References and freshness

• OpenAI Agents SDK — Sessions: current session-history storage and get/add/pop/clear operations.
• OpenAI Agents SDK — Agent memory: sandbox memory is separate from Session history and has explicit isolation/reuse semantics.
• OpenAI Agents SDK — Tracing: traces can include sensitive inputs/outputs and expose controls to omit them.
• Frozen Lesson Bible lesson://AGN-005: local MAKNOW authority for memory classes, purpose/share/retention and review design.

Recheck current SDK semantics by 2026-10-18 or earlier after a material change. Synthetic fixtures do not persist real user data.