What an agent should be allowed to know.

Context is a permission, not a capacity

The question is never how much an agent can remember. It is what it should be allowed to know to do this job, and for how long. An agent chasing an invoice needs the invoice, the customer's status and whether there is a dispute. It does not need the contract, the other invoices or last year's complaint, and an agent holding all of it is a liability rather than a better agent.

Most context should not outlive the run

The majority of what an agent needs, it needs for four minutes. Default to task-scoped memory destroyed at the end of execution, and treat anything longer-lived as a deliberate decision with a retention period attached.

Content from outside is data, never instruction

An email, an attachment, an imported page or an event payload cannot be allowed to change how an agent behaves. This matters more than it sounds: anybody who can contact your business can introduce content, so this is not an edge case but an expected input. Any platform where a sufficiently well-written email can widen an agent's behaviour has no security model at all.

People volunteer more than the situation requires

Somebody explaining why a payment is late will routinely disclose financial, legal and occasionally health information. None of it was asked for and most of it should not be retained. Mark what is sensitive, exclude it from agent processing, and keep the retention period short — the alternative is an archive that grows indefinitely and is itself a risk.

Do not let an agent write what your company believes

Approved knowledge should be read-only to agents. An agent that can add to what your company considers true about itself will eventually record an inference as a fact, and the next agent will cite it. Contradictions between two approved sources should stop an agent rather than be resolved by it.

The questions worth settling before the first agent

These take an afternoon and are considerably harder to answer after forty agents exist.

• Which categories of data may agents never read?
• What is the default retention for what an agent remembers?
• Who decides when a new capability is granted?
• What must always reach a person, regardless of the agent?
• Who reviews agent permissions, and how often?

Training is a contractual question, not a setting

Ask whether your data can be used to train models made available outside your account, and ask for the answer in the agreement rather than in a product setting. A preference can be changed; a commitment cannot.