The research effort in agent memory has gone overwhelmingly into retention, retrieval, and latency — how much can be kept, how well it can be found, how fast. The inverse operations have received far less attention, and the 2026 surveys say so bluntly: prior work optimizes retention while auditable forgetting remains lacking.The framing is drawn from A Survey on the Security of Long-Term Memory in LLM Agents: Toward Mnemonic Sovereignty (arXiv:2604.16548), which organises the problem across six lifecycle phases — write, store, retrieve, execute, share, and forget/rollback — and four objectives: integrity, confidentiality, availability, governance. Most systems have serious answers for the first three phases and thin ones for the last.
We think this ordering is backwards, and not for ethical reasons. Forgetting is not a compliance obligation bolted onto a memory system. It is the maintenance function that keeps the system true. A store that only accumulates is not a memory. It is a log.
Three kinds of forgetting#
Most of the confusion in this area comes from one word covering three operations that have different semantics, different correctness criteria, and different consequences when they go wrong. Systems that conflate them tend to get all three wrong at once.
- Decay is about relevance. Something remains true but stops being worth retrieving. The correctness criterion is precision over time; the failure mode is a store whose top-k slowly fills with stale-but-accurate material. Nothing is lost — the item is demoted, not removed.
- Supersession is about truth. A newer fact contradicts an older one, and the older one should stop being presented as current. The correctness criterion is that the system's answer to "what is the case now" changes; the failure mode is a confidently stale answer. Critically, the old fact is still historically true and may be exactly what a later question needs.
- Erasure is about rights and errors. Something must cease to exist — because it was wrong, because it was private, because someone asked. The correctness criterion is that no trace remains anywhere, including in everything derived from it. This is the only one of the three where retaining the data is itself the failure.
Decay and supersession are ranking and validity problems. Erasure is a deletion problem. A design that treats all three as "drop the row" gets erasure right by accident and destroys recoverable history in the other two cases. A design that treats all three as "mark it inactive" gets decay and supersession right and fails erasure entirely, which is the more common mistake and the more serious one.
The two clocks#
Handling supersession correctly requires something most systems do not have: two independent timestamps per fact. When a thing was true in the world, and when the system came to know it. Naïve implementations record only ingestion time, which breaks the moment a user says "last March" or imports old history.
The distinction is not academic, because the two clocks come apart routinely — and the gap between them is a window in which the store is confidently wrong.
Recording both clocks is what makes two otherwise impossible things possible: asking what the system believed as of a past date, and auditing after the fact which answers were given during a stale window. A formal treatment of exactly this — bitemporal operators for contradiction resolution in persistent agent memory — appeared this year.TOKI: A Bitemporal Operator Algebra for Contradiction Resolution in LLM-Agent Persistent Memory (arXiv:2606.06240). The evidence also cautions against over-correcting: ingest-time contradiction classification by an LLM has performed poorly, and the more robust posture is deterministic version resolution at read time, with timestamps rendered into the prompt so the reader can arbitrate.
Where the model breaks#
Here is the part that is usually skipped, and we would rather state it than paper over it. Bi-temporal marking-without-deletion is the right answer for decay and supersession, and it is fundamentally incompatible with erasure.
A right-to-erasure request cannot be satisfied by tombstoning. "We marked it invalid but retained it for auditability" is precisely what the request forbids. So a serious system needs two mechanisms with opposite guarantees operating over the same store: one that never destroys history because history is the audit record, and one that destroys it irrecoverably on demand. Reconciling those is not a matter of adding a flag. It determines schema, index design, and what the audit log itself is allowed to contain — an audit trail that quotes deleted content has simply relocated the problem.
This tension is sharpest for parametric approaches, where knowledge is folded into weights. That integration is seamless for recall and close to hopeless for targeted deletion and auditing, which is a strong argument for keeping durable memory external and inspectable rather than learned.See Agentic Unlearning: When LLM Agent Meets Machine Unlearning (arXiv:2602.17692) for the state of the art on removing knowledge from parameters, and how far it remains from the guarantee a deletion request actually requires.
Deletion has to propagate#
There is a second-order problem that the layered architectures now standard in this field create for themselves. If raw records are kept as ground truth and facts, summaries, entity observations, graph edges, and embeddings are derived from them — which we have argued elsewhere is the right structure — then every derived layer is a copy. Deleting the source does not delete the copies.
A summary that absorbed a sentence still contains it. An entity node still exists because a deleted memory once mentioned it. A vector still encodes text that no longer exists, and remains retrievable. Each derived layer that improves retrieval quality also widens the surface that a deletion must reach, and nothing about the layer's construction records that obligation unless someone designed it in.
The architectural placement of this logic turns out to matter more than it looks. A 2026 study across thirteen system configurations found that where the control plane sits materially shapes forgetting behaviour — meaning this is a systems-design property, not a policy that can be applied uniformly on top of any storage layer.Control-Plane Placement Shapes Forgetting: An Architectural Study of Agent Memory Across Thirteen System Configurations (arXiv:2606.15903). It is also why several widely used production memory layers delegate deletion and audit consistency to the calling application: not out of negligence, but because doing it correctly requires knowing the full derivation graph, which a general-purpose layer often does not.
Provenance is the precondition#
Every operation described above depends on one capability that current systems largely lack: knowing where a memory item came from. Provenance support remains underdeveloped, and treating memory as provenance-bearing evidence is an open research problem rather than a shipped feature.Two 2026 entry points: From Agent Traces to Trust: A Survey of Evidence Tracing and Execution Provenance in LLM Agents (arXiv:2606.04990), and From Lossy to Verified: A Provenance-Aware Tiered Memory for Agents (arXiv:2602.17913).
Without provenance, supersession cannot be reversed when it fires wrongly, because there is no record of what was superseded by what. Deletion cannot propagate, because the derivation graph was never recorded. A wrong memory cannot be repaired, only deleted wholesale, because nobody can tell which upstream utterance produced it. And a user cannot be told why their assistant believes something about them — which, once memory systems touch anything consequential, stops being a debugging nicety.
Provenance is usually filed under trust and compliance. We would file it under correctness. It is the data structure that makes every maintenance operation in this article implementable at all.
Maintenance is the product#
The reason none of this gets optimized is the one identified in our piece on evaluation: benchmarks score question answering over frozen corpora, so every property discussed here is invisible to them. Selective forgetting is explicitly tested by approximately one benchmark. Deletion propagation, supersession reversibility, and provenance completeness are tested by none. A field measures what it can measure, and then mistakes it for what matters.
Our position is that the interesting frontier in agent memory is no longer how much can be recalled. On a fixed corpus, retrieval is close to saturated and the remaining gains are increasingly gains in the harness. The frontier is whether a store that has been written to, corrected, contradicted, and partially erased for a year is still true, still precise, and still able to explain itself.
That is a maintenance property, and maintenance is not a feature that gets added late. It is determined by decisions made in the schema on the first day — whether there are two clocks or one, whether derivation is recorded or implied, whether history is a side effect or the substrate. Systems that defer those decisions do not get to make them later. They just get to discover which ones they made.