Deletion Across Agent Memory & Derived Data

Definition

Deletion propagation is the process of carrying an authorized removal decision through relevant copies and derivatives of information. Agent systems need to account for retrieved documents, embeddings, summaries, caches and saved task state rather than deleting only the source record.

Deleting one database row does not necessarily remove information an agent can still recall. A derived summary may preserve the sensitive fact without preserving the original identifier. Designing removal requires understanding both stored copies and the transformations that create them.

What it covers

Inventory

Where source and derived information reside.

Decision

What must be deleted, restricted or retained.

Propagation

How removal reaches dependent stores.

Evidence

How completion and unresolved copies are recorded.

Separate deletion from access restriction and retention. Some evidence may need controlled preservation for a legitimate purpose, while active retrieval should stop. Record the basis and owner of that distinction instead of using one indefinite retention rule for every store.

In practice

Practical design patterns by Min.

• Map stores before promising a deletion capability.
• Prevent removed information from being retrieved again.
• Document backup, retention and external-recipient limitations.

Use stable links between sources and derived objects where practical. Test removal with representative synthetic records across retrieval, cache and memory paths. If a store cannot remove individual items, define rebuilding or expiry behavior and disclose the operational delay accurately.

Research notes

Source-grounded details and editorial applications. Follow each link for the original document.

Working example

Why the controls matter

The profile example can fail if a background job recreates a summary from an old snapshot. Include ingestion and refresh jobs in the removal workflow. A completion check should examine the paths the agent can actually use, not only the primary database.

Common pitfalls

• Removing a source while its summary remains searchable.
• Calling embeddings anonymous without analysis.
• Claiming complete deletion from a system that cannot locate derived copies.

Model training introduces a different problem from deleting application memory. Do not imply that removing a stored prompt changes model weights. Identify whether data entered training and route that question through the relevant provider and data-governance process.

Questions for operational review

Use these questions to decide what evidence your team needs. They are editorial prompts, not a compliance checklist.

• Which derivatives preserve the removed information?
• Can ingestion recreate deleted context?
• What limitations must be communicated to the requester?