Memory Is Not Context

A support agent that forgets Maya's accessibility preference repeats work; one that mixes it into every chat can leak it to another customer. Context is text supplied to one model call, thread state belongs to one conversation, and durable memory is a record deliberately retained for later work.

Use this boundary: a prompt may contain the last messages; a thread can preserve unfinished work; durable memory holds a fact such as “Maya prefers email summaries.” Neither an earlier chat nor a model's hidden state is durable memory you control.

Memory needs ownership before search, because an unowned fact cannot be safely retrieved or erased. Start with an explicit SQLite record: Maya's tenant and user identifiers are part of every key, while source and expiry make the record auditable.

import sqlite3

db = sqlite3.connect("support.db")
db.execute("""
CREATE TABLE IF NOT EXISTS memories (
  tenant_id TEXT NOT NULL,
  user_id TEXT NOT NULL,
  memory_id TEXT PRIMARY KEY,
  fact TEXT NOT NULL,
  source TEXT NOT NULL,
  expires_at TEXT
)
""")
db.execute(
  "INSERT INTO memories VALUES (?, ?, ?, ?, ?, ?)",
  ("acme", "maya", "m_1", "Maya prefers email summaries", "user stated", None),
)
db.commit()

This is durable only because support.db survives process restart. It is not semantic search yet; it is the control case Days 02–04 will compare against.

A correct-looking memory result is harmful if it came from another tenant. Retrieval must filter ownership in the database query, not after a model sees the text.

def facts_for_user(db, tenant_id: str, user_id: str):
    return db.execute(
        "SELECT fact FROM memories WHERE tenant_id = ? AND user_id = ?",
        (tenant_id, user_id),
    ).fetchall()

assert facts_for_user(db, "acme", "maya") == [("Maya prefers email summaries",)]
assert facts_for_user(db, "other-tenant", "maya") == []

Positive evidence is Maya's preference. Denial evidence is the empty second query. Add authorization before this call in production; identifiers alone are not identity proof.

Storing every message creates stale, sensitive, and contradictory state. Retain only a fact with a future use, a clear owner, and a deletion rule; keep raw transcripts under separate retention policy.