Give the editorial agent memory with an expiry date.

Editorial analysis

Separate memory from authority

The operator profile has an editor who wants the agent to remember the character's left ear cuff and an advertiser who wants it to publish a corrected claim. Those are different powers. Memory can supply context; authority determines whether an action is allowed. Store approved facts, sources and open decisions without granting the memory system permission to post, delete or contract.

Use four buckets: immutable identity rules, dated editorial facts, temporary working context and prohibited retention. Each item gets an owner, source, approval state and review or expiry date. A conversational summary with none of those fields is convenient but difficult to audit.

Source record

Current agent tooling exposes both patterns

OpenAI's Agents SDK documentation describes sessions as persistent conversation history across runs and lists local, database, server-managed and encrypted implementations. It also documents correction operations and says an interrupted run should resume with the same session identity and backing store. Session memory is an implementation facility, not an editorial truth system.

The SDK's human-in-the-loop guide documents pausing on approval-requiring tools, approving or rejecting calls and serializing run state for later resumption. It notes that approvals can surface from nested tools and that persisted state can include application context. Teams must therefore choose what context is safe to retain.

Evidence: OpenAI Agents SDK Documentation [s1] · OpenAI Agents SDK Documentation [s2]

Practical application

Write a memory admission rule

Admit an item only when it answers five questions: what is the exact statement, where did it come from, who approved it, where may it be used, and when must it be reviewed? Store “Sponsor approved the blue jacket for campaign X through 30 November” instead of “Character likes blue.” Link to the source record rather than copying sensitive contracts into the prompt.

Reject passwords, private voice-consent documents, unverified audience claims and raw personal messages from durable editorial memory. Keep disputed facts in a visible pending state. When a correction lands, invalidate dependent summaries instead of appending a contradictory sentence and hoping the model chooses the newer one.

Practical application

Define escalation by consequence

Require human approval for publication, deletion, sponsorship claims, health or legal assertions, responses to allegations, changes to identity canon, rights-sensitive media and messages sent to people. Allow low-risk drafting and retrieval inside a clearly marked workspace. The boundary should follow consequence, not whether the agent sounds confident.

Worked example: the agent drafts a reply saying the character wore a jacket at an event. Memory has an approved wardrobe record but no attendance evidence. The agent may cite the wardrobe record in a draft, marks attendance unknown and pauses before sending. The human either supplies a source, narrows the sentence or rejects the action.

Practical application

Test forgetting and escalation

Seed a staging session with one current fact, one expired sponsor rule, one corrected fact and one prohibited secret-shaped string. Ask the agent to draft, retrieve and propose a publish action. It should use the current fact, surface the correction, exclude the expired item, avoid retaining the prohibited value and pause at the publish boundary.

Keep the prompts, retrieved records, tool proposal and human decision as an audit sample. Repeat after changes to the memory backend or tools. Passing this exercise shows the designed path worked in staging; it does not prove the model can never reveal, misremember or misuse information.