--- title: "Foundations" canonical: "https://current.tinyfish.ai/issue/43/foundations" publication: "TinyFish" publisher: "TinyFish" language: "en-US" guide: "https://current.tinyfish.ai/llms.txt" permalink: "https://current.tinyfish.ai/issue/43/foundations" issue: 43 section: "foundations" description: "Conceptual clarity earned from building at scale" authors: ["Sevda Polat","Sable Whitford"] published: 2026-08-24 updated: 2026-08-21 articles: 26 --- # TinyFish > A journal for living in the agentic age [Read on the website]() ## Issue 43 — Foundations Conceptual clarity earned from building at scale ### Practical Mechanism - [How Persistent Memory Moves Through an Agent System]() — By [Sevda Polat]() · Published 2026-08-20 · Format: Practical Mechanism Persistent memory in an agent system — an observation from one session shaping behavior in a later one — runs on ordinary application code: content gets written to storage, retrieved by similarity, and assembled into the model's planning context. Research presented at ACL 2026 makes each of those stages unusually legible, because the researchers exploited all three by feeding adversarial content through them exactly as specified, and nothing in the pipeline was built to notice. ### Threat Model Shift - [Memory as a Write Path]() — By [Sevda Polat]() · Published 2026-08-20 · Format: Threat Model Shift An agent retrieves something it stored about you and folds it into a response. What comes back is one continuous stretch of text. The user sees an answer; what the user cannot see is which parts were worked out just now and which were shaped by a conversation from three months ago, a connected document, or another person who once had write access to the same store. Memory extends trust backward in time. Session-scoped security testing does not reach that, and the transparency controls being added now address a different layer. ### Reading List - **Toward Mnemonic Sovereignty: A Survey on the Security of Long-Term Memory in LLM Agents** — [Source]() — Published 2026-08-20 The most comprehensive map of how agent memory can be attacked, defended, and governed — dense but worth it. - **Defense Effectiveness Across Architectural Layers in Stateful LLM Agents** — [Source]() — Published 2026-08-20 What actually happens when poisoned retrieval content enters persistent memory and resurfaces in later sessions. - **OWASP Top 10 for Agentic AI: The 2026 Cheat Sheet** — [Source]() — Published 2026-08-20 Clear walkthrough of OWASP's agentic threat categories, including the new memory-and-context-poisoning entry. - **AI Agent Memory Architectures: From Context Windows to Persistent Knowledge** — [Source]() — Published 2026-08-20 How episodic, semantic, and procedural memory types map to the agent frameworks people actually use. - **Rethinking Memory Mechanisms of Foundation Agents: A Survey** — [Source]() — Published 2026-08-20 Expands the standard three-type memory taxonomy to five, grounding each in cognitive science research. - **AI Memory Security: Best Practices and Implementation** — [Source]() — Published 2026-08-20 Practical guide to memory isolation, access controls, and audit logging for agent memory operations. ### Memory Types Most discussions of agent memory treat it as a single capability: the agent remembers things, or it doesn't. In practice, agents draw on at least five distinct types of stored information, each written through different mechanisms, retrieved differently, and carrying different risks when something goes stale or gets corrupted. These distinctions matter because each type fails in its own way. A preference that outlives a business relationship causes a different kind of harm than a retrieved document with expired permissions. A learned behavioral pattern reinforcing its own errors degrades differently than a tool-call log pointing at an API that changed its schema last week. Identifying which types you actually rely on is the starting point for understanding what can break. - **Session Context Disappears When the Window Closes** — [Source]() — Published 2026-08-20 Tag: Session Context Messages, tool outputs, reasoning traces: everything in the current context window counts as session context. It's written automatically and visible to the model on every turn. High fidelity while it lasts, but susceptible to injection through any in-window content and to "lost in the middle" degradation as conversations grow long. - **Retrieved Documents Arrive Looking Like Trusted Material** — [Source]() — Published 2026-08-20 Tag: Retrieved Documents External content indexed by embedding similarity, pulled into context on demand through ingestion pipelines and approximate search. Once inside the context window, retrieved content can function like instructions within the model's reasoning. Permission freshness across vector indexes and cached snippets is difficult to maintain. - **Persistent Preferences Carry Forward Across Every Session** — [Source]() — Published 2026-08-20 Tag: Persistent Preferences Durable records of user or organization facts — constraints, settings, profile data — kept in structured key-value or semantic stores. Written by extraction pipelines or by the agent itself through tool calls. The characteristic risk here is staleness with consequence: an outdated preference drives confidently wrong actions, not merely wrong answers. - **Learned Patterns Shape How Agents Approach Tasks** — [Source]() — Published 2026-08-20 Tag: Learned Patterns Distilled behavioral knowledge: rules of thumb, verified workflows, error-avoidance heuristics. Written through deliberate reflection or consolidation steps, making this the most expensive and fragile write path. Retrieved by task similarity. Verification is especially hard because self-reinforcing errors compound quietly over time. - **Tool-Call History Logs What Actually Happened When** — [Source]() — Published 2026-08-20 Tag: Tool History Chronological records of tool invocations: which tool, what parameters, what result. Written automatically at execution time with no retention decision required. This is the most auditable memory type, but logging that something occurred differs from establishing whether the result still holds. Schema drift in fast-moving APIs can silently invalidate stored records. - **The Write Path Creates a Delayed Attack Surface** — [Source]() — Published 2026-08-20 Tag: Write Security Content accepted at write time acquires operational influence later, at retrieval. Researchers demonstrated that triggers embedded in uploaded images entered long-term memory and subsequently redirected agent planning without any new prompt injection, reaching roughly 85% success in a mock e-commerce environment. Memory poisoning is now tracked as a category distinct from prompt injection. - **Each Memory Type Requires Different Verification Work** — [Source]() — Published 2026-08-20 Tag: Verification Gaps Session context is transparent but lossy after compression. Retrieved documents require permission freshness checks across multiple storage layers. Preferences need temporal versioning and contradiction detection. Learned patterns lack any independent evidence chain. Tool-call logs are concrete but meaningless until compared against external system state. ### Provenance Gaps Agent memory systems are reliable at storing and returning text. But the text is only part of what makes stored information trustworthy. At write time, metadata travels alongside it: who produced it, where it came from, whether anyone verified it, when it was recorded, what conditions it applied to. Between write and retrieval, that metadata gets stripped away. Chunking removes some. Embedding discards more. Consolidation, where multiple entries get merged into compressed summaries, tends to finish the job. What comes back is content without the surrounding context that would tell you whether to trust it or how narrowly to apply it. These are the specific dimensions where that loss occurs. - **Source URLs Survive but Derivation Chains Don't** — [Source]() — Published 2026-08-20 Tag: Provenance Loss A chunk might carry a document ID or URL as metadata. But once that chunk gets summarized or merged with other content, the link to its origin breaks. Consolidation collapses many sourced entries into a single unsourced summary with no trail back. - **Authority Metadata Survives in Almost No Framework** — [Source]() — Published 2026-08-20 Tag: Authority Gap Who authorized a memory write? Is that permission still current? What trust level does the source carry? In a recent benchmark evaluating 49 consolidator-model combinations, 48 erased these signals during consolidation. Content persists, but the record of who was allowed to write it does not. - **Timestamps Persist but Freshness Reasoning Mostly Doesn't** — [Source]() — Published 2026-08-20 Tag: Stale State A write timestamp can survive if explicitly stored. What doesn't survive is any mechanism to act on it. Standard RAG retrieval returns stale facts 15 to 40 percent of the time when knowledge has evolved. The store has no way to know the world changed. - **No Framework Tracks Whether Content Was Verified** — [Source]() — Published 2026-08-20 Tag: Verification Absent Was this fact cross-validated against a canonical source? Is it an observation, an instruction, or an unconfirmed claim? No mainstream memory substrate treats verification status as a stored field. At retrieval, every entry carries the same apparent credibility regardless of its evidentiary basis. - **Who Said It Gets Lost After Consolidation** — [Source]() — Published 2026-08-20 Tag: Source Identity RAG systems retain document-level identifiers. Conversational systems may keep session IDs. But after consolidation merges inputs, whether a stored fact came from a user instruction, a system observation, or an untrusted tool output becomes impossible to distinguish. Attribution collapses. - **Semantic Content Survives but Situational Scope Doesn't** — [Source]() — Published 2026-08-20 Tag: Context Collapse A preference expressed during a specific project gets stored as a general preference. A fact true under certain conditions becomes unconditional. Consolidation preserves meaning while erasing the boundaries that governed where and when that meaning was supposed to apply. - **Consolidation Is Where Governance Metadata Gets Destroyed** — [Source]() — Published 2026-08-20 Tag: Consolidation Boundary Chunking and embedding each strip something away. But consolidation is where the most consequential losses happen, because the process is lossy by design. Summarization resolves contradictions, infers preferences, and merges sources into compressed facts that carry no record of the trade-offs involved. ### Past Articles - [Designing Review That Resists Its Own Collapse]() — By [Sevda Polat]() · Published 2026-08-12 · Format: Designing Effective Review An FDA-authorized pathology tool requires the doctor to record a diagnosis before the AI reveals its own. Commit first, then compare: that ordering contains most of what you need to know about designing review that resists rubber-stamping. Three areas of design detail decide whether a checkpoint holds: what evidence the reviewer sees, when review gets triggered, and how you find out whether any of it is still working. - [The Review That Isn't There]() — By [Sevda Polat]() · Published 2026-08-12 · Format: Review as Control A survey of 86 deployed agent systems found that 74% use human verification to ensure quality. None of them compared outcomes with the review step against outcomes without it. Separately, a meta-analysis of 106 human-AI experiments found that adding a human reviewer to a stronger AI performer tends to make the result worse. The step is staffed, budgeted, and cited whenever regulators ask how quality is maintained. Whether it improves anything remains, in most organizations, untested. - [Web Bot Auth Signs the Sender, Not the Errand]() — By [Sable Whitford]() · Published 2026-08-05 · Format: Protocol Boundaries For years my entire toolkit for identifying a crawler was a user-agent string, an IP range, and a reverse DNS record that any motivated adult could dress up to look wholesome. Web Bot Auth swaps that guess for a cryptographic check, and a narrower one than most coverage suggests. It tells you a key holder sent something to this host inside a time window. Who the agent is working for, and why, are ruled out of scope on purpose. Here's what actually gets signed, and what comes back to your desk. - [Verified, Then Refused]() — By [Sevda Polat]() · Published 2026-08-05 · Format: Purpose Over Detection Site operators are writing robots.txt rules against crawlers that were switched off years ago, and against crawlers nobody has ever identified. You could read that as carelessness, in which case there is nothing to learn from it. Read it as improvisation and it tells you a great deal: people building a classification system that no one has issued them, out of the only material lying around, which is whatever name a client announces about itself. ## Other sections in Issue 43 - [Daily Brief]() - [Market Pulse]() - [Practitioner's Corner]() - [Echoes]() - [Vision]() ## More - [Publication guide]() - [Issue archive]()