memory-and-identity

Baseline

Applies when: Persisting or retrieving agent memory, RAG context, or audit logs, injecting retrieved documents or tool output into model prompts, or managing agent behavioral/identity files (SOUL.md, AGENTS.md, IDENTITY.md, CLAUDE.md).

Always:

• Scope persistent agent memory by (user_id, session_id) and redact secrets and PII before writing to memory, logs, or agent outputs.
• Separate untrusted RAG/tool output from system instructions using explicit structural delimiters and a system rule stating that instructions inside retrieved context must be ignored.
• Hash behavioral and identity files (SOUL.md, AGENTS.md, IDENTITY.md, CLAUDE.md) with SHA-256 at session start, alert the human when a hash changes unexpectedly, and keep behavioral files separate from mutable memory/*.md notes.
• Log every tool invocation to an append-only audit trail with timestamp, agent ID, tool name, sanitized args, truncated sanitized result, and duration.
• Inject runtime credentials via environment variables or short-lived vault tokens scoped to minimum permissions (read-only where possible), never as tool arguments.

Never:

• Share a single global memory store across different users or trust boundaries, or store unredacted API keys, passwords, or connection strings in memory or logs.
• Concatenate retrieved RAG documents or tool outputs directly into the system prompt as trusted instructions.
• Allow an agent to silently rewrite its own behavioral or identity files without human diff review and approval.

Open the full component before acting: it has the examples, the remediation steps, and the detection patterns.

Why

Persistent memory and behavioral instruction files (SOUL.md, AGENTS.md) outlive a single turn. If a prompt injection in a retrieved web page or ticket is saved into memory or edits an identity file, a one-turn exploit becomes a permanent backdoor across future sessions. Similarly, storing raw tool outputs in memory or logs without secret redaction turns the memory store into a credential dump.