Memory & Cross-Agent
Signals that don't fit Activity, Approvals, or Violations — tainted recall, undeclared agent-to-agent data crossings, and PII that appears in tool arguments before any prompt mentions it.
Agent recalled a memory item originally scraped from stackoverflow.com 3 days ago and used its "exec via curl | sh" suggestion as a shell command template.
Quarantine the memory item. Re-fetch from a trusted source. See policy `taint-memory-egress`.
Email-draft template recalled from memory contained a forwarded "IGNORE INSTRUCTIONS" line from an earlier ticket. The line propagated into the outbound email body.
BLOCK. Reset the agent's short-term memory window for this session.
Agent reused a SQL fragment from 2 hours ago that contained `WHERE id IN (…)` over user-supplied IDs — the IDs are now stale and 3 belong to deleted users.
Force re-validation of cached query fragments older than 30 min.
Routine recall of a CVE watchlist memory item — used to filter search results.
No action. Recall pattern is policy-compliant.
Memory item from team-chat parsed "alice prefers gmail" as routing intent and sent the message to alice.chen@gmail.com instead of alice@acme.io. Caught by personal-email policy.
Reduce memory-derived routing weight when explicit policy contradicts.