Production agents need three distinct memory layers with different retention policies. Session memory holds the current task context — what the user is working on right now, what tools it has called, what results it has seen. This lives for minutes to hours and resets when the task completes.

User memory stores preferences and patterns: 'This customer prefers formal tone,' 'Last time, they wanted a refund not a replacement,' 'They always CC their manager on escalations.' Retain for months, tied to the user profile. Org memory holds company-wide policies, playbooks, and learned patterns: 'We never offer discounts over 15%,' 'Escalate billing disputes to Tier 3.' Retain indefinitely, shared across all users in the organization.

Keep these stores separate with different access controls. A user should not see another user's memory. An agent should not apply one customer's org policies to another customer's. Mixing memory layers is a common source of cross-tenant data leaks.

Memory creates privacy obligations that pure RAG systems avoid. If your agent remembers that a customer complained about a billing error, that memory is personal data under GDPR and similar regulations.

Build memory management into your product from day one: let customers view what the agent remembers about them, export their memory data, and delete it on request. Document memory retention periods in your privacy policy and DPA. Never use customer memory to train models without explicit, informed opt-in.

For enterprise customers, offer memory controls: 'Do not remember anything about executive users,' 'Auto-delete session memory after 24 hours,' 'Do not store content from legal department interactions.' These controls are increasingly required in security questionnaires.

Memory is not always the right choice. In regulated workflows — legal, medical, financial — stale memory is worse than no memory. A legal agent that 'remembers' an outdated statute is dangerous. A medical agent that recalls a previous diagnosis without checking current records creates liability.

Default to fresh retrieval from source systems for compliance-heavy domains. Each agent run should pull the latest policy, the current account record, the most recent account status. Memory is for preferences and patterns, not for facts that change.

The decision framework: if the information might change between sessions, retrieve it fresh. If it is a user preference or organizational pattern that persists, memory is appropriate. When in doubt, RAG over memory — it is easier to add memory later than to fix compliance issues from premature personalization.