Lina’s shipping assistant offered the office address used for her last parcel. It was real, familiar, and wrong for today’s order, which specified her home. “Does this address look valid?” would not catch the mistake. Opening this parcel’s order would.
“Do not store mutable or sensitive facts in AI memory” leaves the operational question unanswered: where should an address, deadline, budget, or consent status live, and how should an assistant obtain it? Put the fact in a maintained, traceable record, then require an explicit read immediately before it enters a shipping, booking, payment, writing, or notification tool. Memory may nominate a field; only current evidence may populate the action.
OpenAI’s Memory FAQ says a memory summary changes with conversation but may not expose every detail or source that shaped a response; older memory could also become stale or contradictory. “I remember” does not show when a value was valid or whether its record changed.
Give each fact a maintainable home
There is no universal database called “the source of truth.” Authority follows the job:
- A response preference, such as concise answers or no cilantro, can live in inspectable personalization. It affects reversible output and remains easy to correct.
- A transaction value belongs to that transaction: the shipping address on this order, the amount on the approved invoice, or the time on the appointment. A profile default may prefill a draft but must not override the instance.
- A changing operational fact belongs in its managed system: contacts in the CRM, stock in inventory, deadlines in the project tracker, availability in the live calendar, and approved budgets in the ledger. The record needs an owner and freshness evidence.
- Sensitive, third-party, and consent-bound information belongs only where purpose, ownership, access, and retention are defined. Without an approved home, ask the authorized person for this use and do not persist the answer by default.
This extends source-of-truth checks for company numbers. The current order is authoritative for this parcel because its scope matches the action; the approved calendar event plays that role for a meeting.
- What will this value cause next?
- Only change reversible contentShow the cited preference and make correction immediate
- Ship, book, pay, write, or notifyName the transaction or live business record, then fetch and compare it before execution
- Use sensitive, third-party, or consent-bound dataRequire a purpose, owner, and read permission; otherwise neither store nor reuse it
Make retrieval a required step, not a helpful suggestion
“Are you sure?” asked in the same chat is not verification. It lets the memory system certify its own output. The check must change channels and occur before the execution component accepts parameters.
For Lina’s parcel, memory may tell the workflow that a shipping-address field is needed. A read-only order tool then queries order_id=842 and returns shipping_address with the record version. The preview shows the value, record identifier, and retrieval time. Lina’s approval binds this parcel, this address, and this shipping call. The shipping tool rejects addresses supplied directly by memory.
The same contract works elsewhere: read the current calendar before booking, the approved invoice before paying, and the case-specific recipient list and consent state before notifying. An API is optional; a restricted read tool or current-user confirmation also works. The input simply needs an explicit, scoped path.
Missing records, insufficient permission, an expired version, a mismatch, or an unconfirmed record must produce a draft and a question. The assistant must not choose what “looks newer” or save a one-time answer as durable memory.
Anthropic’s memory-tool documentation makes the application responsible for executing requested operations against controlled storage, including sensitive-data checks, expiration, size limits, and path protection. OWASP adds validation before persistence, user and session isolation, and exact action-bound approval. Memory is a governed data layer; model confidence cannot maintain it.
Correct the record first, then close the routes back in
When Lina spots the old address, the immediate correction belongs on this order. If her profile default is also obsolete, an authorized owner updates it and leaves a trail. Then the team invalidates memory, chats, caches, or connected sources that could return the old value.
OpenAI says complete removal may involve chats, files, the memory summary, and connected apps. Google says deleting chats or disconnecting one app can leave another route. Record the changed source and owner, invalidated memory, and remaining routes. Without provenance or removal controls, allow previews—not Send.
A memory relevance check removes unrelated details, but a relevant address can still be stale. Relevance admits a lead; current-source verification admits a tool parameter.
Pilot one action that leaves the chat
Choose one parcel, booking, or notification. Record each action field’s source, query key, owner, and freshness rule. Show the retrieved value, record, and version in preview. Let execution accept only values covered by a specific approval.
If the team cannot explain where a value is maintained, how this run retrieves it, what proves it is current, and who approved these exact parameters, stop at draft. Avoiding one repeated question is personalization. Completing the right action with current evidence is automation.
AI handoff card
Inspect, read-only, one shipping, booking, payment, writing, or notification workflow I authorize you to see, including memory, retrieval tools, and connected sources. Do not modify records, memory, or settings or invoke external-effect tools. List every action field with its remembered value, maintained authoritative record, query key, owner, version, and read permission; write “unknown” instead of guessing. Name the read-only retrieval, tool, API, or current-user confirmation that must obtain it before action, then compare the values. Mark “STOP” when a source, permission, or version is missing or values disagree. Finish with one non-executing preview naming the tool, target, parameters, source evidence, approver, and expiry, then stop without changing the source or saving long-term memory.
The address gets four separate checks
- The AI helper takes an old blue address tag from the archive and offers it for the parcel Lina is preparing; it is only a remembered candidate.
- Lina is about to apply the blue tag and pass the parcel to the courier cart, but she stops before shipment.
- Lina opens the current order from a separate inbox and compares its coral address tag with the old blue one.
- Lina ships only after applying the verified coral tag; the current order remains on the table and the old tag goes back to the archive.
Lina’s near-miss shows why a plausible AI memory of the past is not necessarily true today. Reusable facts such as addresses belong in maintained, checkable records, not only in memory. By returning to the current order before acting, the assistant can finish with the verified coral tag.
References
- OpenAI Help Center: Memory FAQ — https://help.openai.com/articles/8590148-memory-faq [accessed: 2026-07-30]
- Anthropic Claude Platform Docs: Memory tool — https://console.anthropic.com/docs/en/agents-and-tools/tool-use/memory-tool [accessed: 2026-07-30]
- OWASP Cheat Sheet Series: AI Agent Security Cheat Sheet — https://cheatsheetseries.owasp.org/cheatsheets/AI_Agent_Security_Cheat_Sheet.html [accessed: 2026-07-30]
- Google Gemini Apps Help: Get personalization with memory of your past Gemini chats — https://support.google.com/gemini/answer/16598469 [accessed: 2026-07-30]
