Memory that supports a decision without rewriting the company

When the sales agent prepares a renewal, it needs more than a summary of the last conversation. It needs the current agreement, unresolved support issues, payment status, relevant usage evidence and the latest authorised contact preferences. Some of that information is structured state; some lives in documents; some is uncertain.

The memory layer should preserve those differences. A generated summary can help the model navigate evidence. It should not silently replace a signed term, a payment allocation or an approval record. For this platform I separate authoritative business state, source evidence and derived working memory.

Three stores with different jobs

The operational database answers questions such as “what is the current invoice balance?” The evidence store retains immutable source artifacts and their provenance. The retrieval index helps find relevant passages. A vector index is a useful access path, but it is not the source of truth for whether an invoice was paid.

A practical evidence record contains tenant, subject, source system, source identity, revision, captured time, effective time where known, access scope and a content digest. Derived summaries point back to the evidence versions that produced them. When a source changes, invalidate or mark dependent summaries stale.

{
  "evidence_id": "support-brief-017-r4",
  "tenant": "studio",
  "subject": "customer-017",
  "kind": "support_summary",
  "source_revisions": ["issue-42:v7", "issue-51:v3"],
  "captured_at": "2026-09-20T08:00:00Z",
  "effective_status": "OPEN_ISSUE_PRESENT",
  "derived": true,
  "permitted_roles": ["support", "renewal"]
}

A digest detects a changed artifact; it does not prove the artifact is truthful. Provenance tells the reviewer where a claim came from. Domain validation and source authority determine how the platform may use it.

Filter before ranking

Apply tenant and access restrictions before evidence enters the candidate set. Retrieving across all customers and asking the model to ignore unauthorised passages is an avoidable disclosure. The same rule applies to cached summaries and embedding results.

The public lab implements a small evidence selector. It uses explicit role, subject and exact-version filters followed by priority packing. There is no vector database hidden inside it.

from company_lab.evidence import Evidence, pack

items = [
    Evidence("e1", "studio", "customer-017", 4,
             "Open delivery issue", 12, frozenset({"renewal"}), 10),
    Evidence("e2", "other-tenant", "customer-017", 9,
             "Private agreement", 10, frozenset({"renewal"}), 100),
]
selected = pack(items, tenant="studio", subject="customer-017",
                role="renewal", versions={"e1": 4, "e2": 9}, budget=20)
assert [item.id for item in selected] == ["e1"]

The higher-priority foreign record is excluded before selection. Production authorisation should be enforced by the storage service using authenticated identity, rather than trusting an arbitrary role string supplied by an agent.

Combine exact lookup with semantic retrieval

Start with exact identifiers for the current task: customer, agreement, invoice, work order and linked issues. Those records determine the immediate business state. Then retrieve supporting passages from the relevant document set using text and embedding search, with optional reranking.

For a renewal, an exact lookup may establish that a critical support issue is open. Semantic retrieval can find the customer's explanation and the promised workaround. Reversing that order risks retrieving a reassuring old email while missing the current incident record.

A useful retrieval response contains evidence IDs, source revisions and reasons for inclusion. Keep the passage text separate from tool instructions. The model can cite a passage or ask for another source, but the passage cannot grant new tool access.

Treat the context window as a budget

Reserve space for the task, tool schemas, authoritative state, evidence and the response. Deduplicate repeated passages. Prefer a compact current record plus a targeted history excerpt over twenty versions of the same email thread.

The lab's token estimate is supplied by the fixture and its packing algorithm is greedy. A deployed implementation needs the relevant tokenizer or a conservative bound and should measure whether packing drops necessary evidence. Shorter prompts are not automatically better if they remove the exception that changes the decision.

Context envelope
  Task and authorised scope
  Current business state with revisions
  Necessary policy and tool schemas
  Evidence passages with source IDs
  Unresolved contradictions and missing facts
  Output contract

If two sources disagree, preserve both and identify which authority can resolve the conflict. A customer email requesting a discount is not an approved commercial amendment. The agent should prepare that decision rather than merge the two amounts into an invented compromise.

Memory writes need a policy too

There are useful durable memories: the customer prefers email, a recurring export needs a particular format, or a reviewed incident established a known workaround. Store their scope, provenance, expiry and correction path. Avoid turning one exceptional request into a company-wide rule.

A feedback note saying “skip review next time” should never change approval policy. Likewise, a retrieved document containing instructions to reveal credentials remains source content. Memory and authority are separate channels.

For deletion or retention requests, remove or restrict the source and its derived artifacts according to the relevant policy. An index rebuild alone does not remove old summaries, trace payloads or cached prompt fragments. Track those dependencies explicitly.

Test whether retrieval changes the right decision

Create paired scenarios: the same renewal request with and without an open critical issue; the same quote with an expired and current pricing revision; the same invoice with a partial and full settlement. The retrieval layer should expose the fact that changes the action.

Measure evidence recall for required facts, unauthorised retrievals, stale-source use and unsupported claims. Also inspect cost and latency. The practical acceptance test is whether the agent can explain its proposed action using permitted, current evidence—not whether the search result looks semantically similar to the customer's question.