Agent memory does more than retain facts. It selects what will later be retrieved, summarised and used in decisions. A procedure that worked yesterday may become the wrong instruction when the target, version or permissions change. The agent’s name may stay the same while the conditions governing its actions do not.
In Swarm, I therefore distinguish functional identity, influenced by experience and context, from authenticated identity and actual authority. Behavioural continuity does not automatically preserve permissions.
Yesterday’s fix, today’s wrong environment
Imagine an intervention in a test environment. An agent resolves an incident by resetting a component and retains the procedure as useful experience. In a later session, retrieval selects this memory for a similar incident affecting a production resource. The summary kept the command but lost the condition “test only”.
Without a context check, semantic similarity can become the justification for an out-of-scope action. Depending on the resource, a reset could interrupt service, remove useful state or hinder investigation.
Retained experience can inform a decision. It does not transfer the permissions of its original context.
“Is this memory relevant?” is insufficient. Which source and version does it concern? Under what conditions did the action succeed? Who can authorise it now? A recommendation must remain separate from approval to execute it.
Retrieving a source does not prove validity
Governed memory should retain originals, identify transformations and permit withdrawal of unsuitable references. A summary should not hide a contradiction or material failure. Provenance supports investigation and qualification; it does not make attributed content true.
The OWASP Top 10 for Agentic Applications provides a dedicated security framework for these systems. In this case, examination must cover both reused content and the authority the process assigns to it.
Withdrawal also has a temporal limit: removing a reference does not automatically retract copies already delivered to a provider, process or another instance. Tracking must distinguish sources still available for selection from contexts already delivered.
Contracts currently present in Swarm
The documented Rust path retains memory references in Work and carries them into context preparation objects. It rechecks certain availability and project membership conditions before launch. An absent, out-of-scope or incompatibly managed reference must not become successful preparation.
This scope establishes neither automatic injection of every file’s content into a prompt, nor immutability until consumption, nor authentication of the agent reading it. The versioned catalogue, summaries, conversation resumption and future memory permissions are not all globally qualified in Rust.
Identity contracts distinguish the principal, logical agent, instance and content author. These distinctions prevent a role name from standing in for authenticated identity. Alone, they do not establish human approval or end-to-end provider identity.
What recovery should reveal
In this scenario, the process should recover the original condition, identify the changed target and keep the sensitive action pending. An appropriate procedure and current authority can then be assessed. Memory remains valuable: it accelerates analysis without becoming a shortcut around control.
The Swarm repository exposes this progressive separation of memory, identity and authority. Effectiveness must be assessed on the paths actually used, including copied contexts and recovery.