Agent memory: retention controls before rollout

Persistent memory makes AI agents far more useful in daily work: they can reuse earlier conversations, working context and preferences. On August 25, Anthropic announced a memory feature for Claude Cowork with editable topics; according to the release note, it is off by default for Team and Enterprise organisations. That default is a useful reason to treat an agent’s memory as an enterprise data store, not as a convenience feature.

Do not just store data — limit it

An agent with access to email, documents or business systems can collect context that helps with its next task. Google Cloud aptly describes these systems as “ultimate insiders”: they read data and trigger API calls. That increases usefulness, but also raises the question of which information an agent may retain, and for how long.

A retention concept should separate three layers:

• Session context: what is needed only for one task and discarded afterwards?
• Working memory: which reusable facts may be stored for a clearly defined process?
• Organisational knowledge: which content belongs in approved knowledge sources with an owner, versioning and regular reviews, rather than in an individual agent memory?

Access and approval belong together

Memory is not a neutral copy. Retained context can influence a later decision even when the original permission has changed. Define a business owner, retention period and correction or deletion path for every memory. For sensitive categories, disable storage explicitly or permit it only after documented approval.

Google also points to indirect prompt injection and tool poisoning as new risks: not only data access but content in the context can influence an agent’s action. Teams should therefore log which sources contributed to a task and couple critical actions to human approval.

A pragmatic start for DACH organisations

Do not start with organisation-wide permanent memory. Choose a process with a clear data class, for example internal IT requests without special categories of personal data. Set a short retention period, test deletion, and sample whether the agent uses incorrect or outdated memories.

The rollout question is therefore not, “Can our agent remember?” It is, “Who can see, correct and delete every retained item in time?” Only when that answer is operationally robust does memory become a controllable enterprise building block rather than a product feature.