Persistent agent state needs controls matched to its consequences: audit lineage for learned procedures, source evidence for permissions, and bounded reconstruction when revoked information may remain in derived runtime state.
Long-running agents retain state for useful reasons. A computer-use agent can save a procedure instead of rediscovering it. An executor can carry permission across interactions. A runtime can compress earlier context into summaries and plans. The engineering mistake is treating these artifacts as interchangeable because all are called “memory.”
Illustration, hypothetical: an agent receives a preference at step 20, includes it in a summary at step 30, and uses that summary to form a plan at step 40. At step 50, an operator deletes the original preference record. One representation is gone, but the summary and plan may still reflect it. If a similar record says an action is allowed, its current value may also hide whether any valid event granted that authority.
These failures require different controls. Forgetting Without Restarting studies information propagated into runtime state. Authorization Laundering studies permissions detached from supporting events. Persistent Skills supplies the useful counterweight: retained procedures can improve an agent, while their history can make library operations inspectable.
Start with procedural memory. Persistent Skills keeps a library outside the model. Interaction traces and evaluator feedback can produce a new or revised skill, which later tasks can retrieve. Adaptation happens through external state rather than model training. The library records Lineage for each artifact.
The system fixes each skill’s origin task, records every accepted edit with its contributing task and resulting revision, and records each retrieval with the consumer task, iteration, and delivered revision. The authors caution: “Telemetry establishes what was retrieved, not its effect on execution.”
Lineage can show which revision was delivered and how it evolved. It cannot show that the executor followed the procedure or that retrieval caused success. Nor does this library telemetry follow information through summaries, plans, model state, or tool effects.
Revocation needs a broader model. Forgetting Without Restarting represents the runtime as a Deterministic transition system. When a target enters at step τ, later summaries, pending plans, and KV cache state can depend on it. The desired result, Execution-state unlearning, is the state that would have existed had the target never entered the observation stream.
The paper’s Provenance-Guided Selective Replay records artifact dependencies and checkpoints. After revocation, it restores the clean prefix before τ, removes the target, and recomputes the affected suffix. This reaches derived runtime state, but requires stronger execution control than skill-library telemetry.
Permissions occupy a narrower layer. Authorization Laundering examines evolving grants, restrictions, and revocations. A compact current record can falsely claim authority when supporting history is lost or miswritten. Requiring a permission to point to valid source events, or preserving a limited change sequence through Bounded event sourcing, lets an executor test the current claim. These controls validate authorization state; the paper does not show that they clean other runtime artifacts.
The central correction to a delete-based mental model is that absence of a string is not absence of influence. Forgetting Without Restarting tests both elicitation, which asks whether a target remains recoverable, and behavior, which asks whether it still changes action. Across three instrumented agent suites, the unlearning paper reports that deleting persistent memory left any-leak at 0.86–1.00, forget instructions produced Leak@probes = 1.00 under a six-probe audit, and source redaction still caused action on a revoked preference in 80% of episodes while emitting the forbidden string zero times. These are results from the tested suites and baselines, not deployed prevalence, and the leakage and behavioral tests measure different failure modes.
The replay result explains why deleting one artifact was insufficient there. Under the paper’s deterministic transition-system model and without token-level attribution, exact execution-state unlearning requires recomputing the suffix from injection step τ through T, at least T−τ+1 transitions. Provenance-Guided Selective Replay matched the full-reset audit floor while using up to 9× fewer recomputed tokens. The bound depends on the formal model. The experiments span three suites and three model families, but do not establish safe replay for arbitrary irreversible or nondeterministic external tool effects.
Persistence still has measurable upside. In a configuration-matched longitudinal OSWorld comparison with fixed action-generation and GUI-grounding models, Persistent Skills reports: “Full achieves higher post-warm-up mean evaluator score in every domain, with mean differences relative to the control ranging from 5.7 to 18.6 percentage points.” This tests the integrated evolving library, not provenance alone. It covers one run per condition-domain pair in four observed domains, repeated fixed task sets rather than held-out transfer, and a Writer warm-up imbalance.
The same study separates audit evidence from causal evidence. In the paper’s 35-iteration GIMP run, “43.3% retrieve a skill created by another task,” but the authors state that this “does not, however, establish causal transfer.” A repeatedly edited skill family also coincided with success in only 2 of 35 iterations, or 5.7%. Detailed provenance covered GIMP only. The churn does not identify whether skill selection, action generation, or grounding was the bottleneck.
Authorization creates a different path from memory error to consequential action. In EAL-Bench across procurement, cybersecurity, and finance, five LLM memory writers created false authority for up to 50.2% of unauthorized requests under incremental updates; once false authority was present, two executor models acted on it in 98.6% of trials. Authorization Laundering provides abstract-level benchmark evidence, so these figures do not estimate deployed prevalence.
The authorization paper reports that requiring stored permissions to be backed by valid source events and tracking permission changes through bounded event sourcing “substantially reduce laundering,” but both reject more legitimate actions, producing a safety-utility tradeoff. The supplied abstract does not provide exact reduction or rejection rates. Unlike selective replay, these safeguards check authority rather than reconstructing an entire runtime suffix.
Classify persistent state by consequence and propagation. For learned procedures, record origins, accepted revisions, and retrievals when operators need an auditable account of library evolution. If the real question is whether a skill improves performance, add an adherence or outcome test. Retrieval logs cannot answer it.
Where stored state can authorize consequential actions, retain the valid source events needed to check that authority and consider bounded event sourcing. Where a revoked input may have propagated into reconstructible runtime state, preserve enough provenance and checkpoints to support replay only under the unlearning paper’s deterministic-model and attribution assumptions. Keep skill-library lineage as an audit record, without treating it as complete cross-layer provenance.
For persistent state that can authorize action or preserve revoked information, the papers support retaining source history and layer-appropriate lineage rather than relying only on the current mutable record. Skill provenance demonstrates auditability of library operations; the unlearning study shows that revocation can extend into derived runtime state under its model; and EAL-Bench shows that source-backed authorization can reduce false authority at a utility cost.
No result supports one universal event history or selective replay for every memory entry. Storage, latency, legitimate-action loss, and handling of external side effects remain unmeasured across the combined proposal.
The control choice changes with the question being asked. If an operator needs to reconstruct how a reusable procedure evolved, library lineage is enough to expose origin, revision, and retrieval. It still cannot prove that a retrieved skill changed execution, so performance attribution needs a separate experiment.
If stored state grants authority, the decisive question is whether valid source events justify the grant. Preserving those events can catch permissions invented by incremental memory updates, although stricter validation can block legitimate work and needs domain-specific testing.
If the requirement is genuine revocation, deleting or redacting the visible record is a weak test. Derived summaries, plans, and runtime state may preserve behavioral influence without reproducing the forbidden text. Selective replay offers a reconstruction method only where the runtime is instrumented, its deterministic assumptions fit, and consequential side effects can be handled safely. The papers therefore support three scoped controls, not one universal memory architecture.