A guard that sits between the agent and any memory backend and withholds records that are revoked or conflict with their replacement is developed, finding that no system enforces revocation by default.
Abstract
Long-running language-model agents depend on persistent memory. Many agent-memory systems preserve history through soft revocation: a contradicted fact is marked invalid and retained rather than deleted. However, whether that mark is enforced at retrieval time is unexamined. In this paper, we measure five such systems: we load each with a revoked policy and its replacement, track whether the revoked fact is returned at retrieval and whether the agent then acts on it across nine policy scenarios and nine models, and score every trial under six defense conditions. We find that no system enforces revocation by default: the revoked fact is returned wherever the revocation label is visible to the retrieval layer, outranks its replacement, and leads agents to the unsafe action. Based on these findings, we develop a guard that sits between the agent and any memory backend and withholds records that are revoked or conflict with their replacement.
The introduction of TEPA, a revocable evidence-memory mechanism that makes validity an explicit state of memory, and the results establish lifecycle revocation as a core memory operation for agents that must falsify, audit, and later re-promote evolving knowledge.
Yan Zhou, Yue Ouyang, Kaiyang Zheng et al.· 3 citations· ⚡1
TRACE is presented, a training-free layer that treats re-entry as an eligibility decision rather than a storage or retrieval operation, reconciling a departure checkpoint against absence-period updates, resolving explicit and implicit invalidation, and releasing a bounded Return View only when it covers the returning r...
Wen-Jun Xiong, Shengtao Zhang, Shangding Gu et al.· 0 citations
As language agents persist and collaborate over long horizons, a stored fact is no longer disposable context: once recalled, it steers tool calls, planning, and cross-agent agreement. We argue that memory reliability breaks down into two distinct failure modes: staleness (the world changed after a fact was stored) and...
Ming Wang, Ke-Yang Han, Ru-Yi Wang et al.· 2026 12th International Conf...· 0 citations
This work evaluates five LLMs as memory writers and two as executors across procurement, cybersecurity, and finance and introduces EAL-Bench, which measures how accurately persistent memory preserves evolving authorization state and whether errors propagate to downstream unauthorized actions.
Tommaso Cerruti, Mika Okamoto, Ansel Kaplan Erol· 4 citations· ⚡1
This work identifies one structural contributor: draft-anchored verification checks what a response says, and in an open-ended response the stale dependency is usually unsaid, so StateAuditor audits in the opposite direction, from stored state to draft.
Tool-using language agents can delegate and revoke permissions while acting through external services. We show that two authorization histories can have identical current permissions and identical all-pairs reachability yet require opposite decisions after the same direct-edge revocation. We formalize the information n...
