Memory is a data store. Treat it like one and most of the problems around agents misusing long-term memory or leaking sensitive data disappear. The mistake teams keep making is treating memory as free storage that only helps — every byte your agent retains is a byte you now owe a retention policy, a deletion path, and an answer to the question, "why does it know that?"
When a thread pops up asking how to stop an agent from recalling things it shouldn't, the answer is almost never "better prompts." It is governance for the memory layer itself.
Decide what memory is for — and what it must never hold¶
First, define the purpose: task context, run IDs, user preferences for the current session — operational stuff. Then define what memory must never hold: credentials, PII, customer data, and anything the agent picked up from untrusted content. That last class matters because untrusted content in memory is a prompt-injection vector with a filing cabinet — the malicious instruction gets persisted, re-read, and eventually acted on.
Write both lists down. The deny-list of data classes is the load-bearing one: it is the set of things the memory layer refuses to persist, automatically, every time.
Enforce the deny-list in code, not in the system prompt¶
A memory write for a blocked data class should get dropped and logged — never stored. And it has to be enforced in code, as a rule in the memory layer, not as a guideline in the system prompt. Guidelines are suggestions the model can be talked out of; a code-enforced deny-list holds even when the model is confused, compromised, or simply being creative about what counts as a preference.
Session-scoped memory with a TTL¶
Everything expires after a short window unless explicitly promoted. Stale memory is both a liability and a source of strange behavior — agents reasoning off week-old context make week-old mistakes. Expiry is cheaper than audits: set a time-to-live on every memory entry by default and require a deliberate, recorded promotion step to keep anything longer.
Audit memory before long-horizon runs¶
Before you let an agent run for hours unattended, dump what it currently "remembers" and read it yourself. You will be surprised what accumulated. This is the cheapest security review you can do: a five-minute read of the memory store before a long run surfaces credentials someone pasted once, PII the agent scraped from a document, and instructions it picked up from a web page weeks ago.
The takeaway¶
A retention policy, a TTL, an enforced deny-list, and a pre-run audit — that is the whole system. The free MIT-licensed Governed Agent Mesh Playbook includes a memory-hygiene checklist with the copy-paste version if you want it, but the three practices above are what actually change outcomes. Give your agent's memory a data-retention policy before it needs one, because by the time it needs one, the bytes it is holding are already your problem.