Agent memory is a data store. Whatever an agent carries from one task to the next has been retained, can be accessed later, and can shape future decisions about other people. That makes memory a decision about retention, access and purpose, and it should be made with the same care, the same owner and the same review as any database holding customer data.
Why does memory not feel like a data store?
Memory is usually presented as a feature. The agent "remembers your preferences" or "learns from past conversations", and it sounds like something a good assistant should do. It is often switched on by default in agent frameworks, configured by an engineer in a few lines, and described in product terms rather than data terms.
Look at what it actually is. Text from earlier tasks, sometimes summarised by the model, is written somewhere and read back later. That text may contain names, account details, health information disclosed in a complaint, or a note that a customer seemed confused. It sits outside the systems of record, often outside the data inventory, with no defined retention period.
If a team proposed a new database with those properties, it would go through design review, a data protection assessment and an access control review. Memory deserves the same.
What kinds of memory does an agent have?
The word covers several things, and each raises different questions.
| Kind of memory | What it holds | The decision it involves |
|---|---|---|
| Within a task | The conversation and tool results so far | How much context to pass forward, and what to drop |
| Across tasks for one customer | Notes or summaries from earlier interactions | Whether this customer's history should shape later answers, and for how long |
| Across customers | Patterns or examples the agent reuses | Whether one person's data can influence another's outcome |
| Cached reads | Copies of data fetched from source systems | Whether stale copies can be relied on, and who can see them |
The third row is the one to watch most closely. Memory that carries details from one customer's case into another's is a disclosure risk, and it can also bias outcomes in ways nobody designed.
Every kind of memory starts with what the agent was allowed to see. If an agent pulls a full customer record to answer a question about one transaction, the whole record is now in its context, and anything in its context can end up in memory. That is why every tool call is a decision, reads included.
Narrow reads make for safer memory. An agent that fetches only the fields it needs has less to retain. The same principle applies at larger scale when you give an AI agent read access to a data warehouse: scope the access to the job, because whatever the agent reads it may also keep.
What do data protection rules have to say?
Under GDPR and UK GDPR, personal data an agent retains is personal data like any other. The Article 5 principles apply: it must be collected for a specified purpose, limited to what is necessary, and kept no longer than needed. Retention in agent memory needs a lawful basis under Article 6, and it belongs in the records of processing that Article 30 requires. Where memory is used in ways likely to create high risk, a data protection impact assessment under Article 35 is the place to examine it.
These obligations do not change because the store is called memory. The detail is in does GDPR apply to what an AI agent remembers?, including how data subject rights reach into agent memory.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
When does memory shape a consequential decision?
Memory matters most when it feeds a decision with real effects on a person. If an agent preparing a credit recommendation remembers that a customer once missed a payment, mentioned in a past complaint but not in the credit file, that memory has become an input to a consequential decision. It was never assessed as a credit data source. It may not even be accurate.
That is a reason to keep memory out of high-consequence decisions unless it has been treated as a governed source with a provenance class and an owner. For decisions that are hard to undo, the question of whether a credit decision is reversible shows why: an outcome shaped by an unvetted memory cannot easily be taken back.
How should memory be decided?
Treat each agent's memory as a design choice with an owner, written into its brief.
- Purpose. What is memory for in this role? If there is no clear answer, the default should be no memory across tasks.
- Scope. Which fields may be retained, and from which sources? Exclude special-category data unless there is a specific, documented need.
- Isolation. Is memory kept per customer, and never shared across customers?
- Retention. How long is each kind kept, and what deletes it?
- Access. Who can read it, and is that access logged?
- Provenance. If memory can inform an action, what class does a remembered fact carry? Usually no stronger than the source it came from, and often weaker once summarised.
Where Pryme fits
In Pryme, memory is part of the agent's brief: what may be carried, for how long, and for what purpose. Remembered facts carry their provenance like any other fact, so a summary of a customer's past declaration cannot quietly become authority for an action. See the governed agentic operating system, explained.
Questions people ask
Should agents have memory at all?
Within a task, yes, or they cannot finish their work. Across tasks, only where a role clearly benefits and the data decision has been made deliberately. No memory is a sensible default for new agents.
Can a customer ask for an agent's memory of them to be deleted?
Where data protection law gives them that right, it applies to agent memory as to any other store. That is much easier to honour if memory is isolated per customer and indexed by customer reference.
Does summarising memory make it safer?
It reduces volume but adds risk of distortion, because the summary is the model's interpretation. A summarised memory should carry a weaker provenance class than the facts it summarises.