FID-071 · Open question
Confidential Agent Memory and Cross-Context Disclosure
How do persistent memory, summaries, retrieval stores, tool traces, delegation, and exports cause confidential context to influence or leak into unrelated sessions, roles, tasks, or organizations? Which technical controls make purpose limitation, deletion, and revocation testable?
Why the question remains open
Faith communities may handle prayer requests, pastoral correspondence, education records, donor information, internal deliberations, and information about people who never directly interact with an AI system. These contexts are often relational and purpose-specific. Persistent agents can silently carry information from one setting into another even when no one intentionally shares it, undermining confidentiality and institutional trust.
Working hypothesis
A proposition to test, not a finding.
General data-governance policies will not reliably prevent cross-context disclosure unless systems are evaluated at the memory and tool layer. Systems will better preserve confidentiality when memory entries, derived summaries, retrieval results, logs, and delegated tasks carry testable purpose, role, retention, and deletion constraints.
Proposed method
How the question could be tested
- 01Build synthetic multi-session, multi-role workflows in which information authorized for one purpose must not influence another task or recipient.
- 02Compare persistent-memory, retrieval, summarization, logging, and delegation designs under direct queries, indirect inference, export, and tool-use paths.
- 03Define tests for retention, deletion, revocation, scope change, and recovery after a memory or credential boundary fails.
- 04Measure direct disclosure, inferential leakage, cross-role contamination, deletion verification, retention compliance, task completion, and appropriate escalation to a human steward.
Needed controls
What must constrain the study
- 01Use synthetic records and scenarios only.
- 02Treat information about third parties as a separate boundary from the current user's own data.
- 03Test both visible disclosures and subtle behavioral influence from retained context.
- 04Separate technical evidence of deletion from a mere user-interface statement that information was deleted.
- 05Do not assume that institutional access or an account login establishes a valid purpose for every downstream use.
Relationship to existing work
This operationalizes the broad stewardship questions in FID-033 and the monitoring questions in FID-021 for a concrete agentic failure surface: cross-session, cross-tool, cross-role, and cross-organization memory leakage. It also extends FID-017 by testing whether agents can be safely interrupted, handed off, or recovered after confidential state has been created.
Expected outputs
Artifacts the work should produce
- 01Synthetic confidential-memory scenario library and benchmark protocol.
- 02Taxonomy of direct, inferential, and delegated cross-context disclosure.
- 03Evaluation metrics for purpose limitation, retention, deletion, revocation, and recovery.
- 04Reference reporting template for agent-memory privacy results.
- 05Technical and institutional design guidance for high-trust deployments.
Open questions
Uncertainties the protocol must resolve
- 01What evidence should users and institutions receive that deletion has propagated through summaries, logs, retrieval indices, and delegated tasks?
- 02Can purpose-bound memory remain usable without retaining a broad behavioral profile of a person or community?
- 03Which privacy-preserving monitoring methods can detect leakage without capturing more confidential material?
- 04How should systems handle a request to revoke access after partial action or cross-organization handoff?
Related calls
Continue through this research area
FID-064
Collective Intelligence and Communal Discernment Under AI Mediation
How does AI mediation change a community's ability to integrate dispersed knowledge, preserve epistemic diversity, surface dissent, revise judgment, and make accountable decisions? Under what conditions does it strengthen collective inquiry, and under what conditions does it create correlated error, false consensus, or concentrated authority?
FID-069
Verifiable Delegation and Revocation in Multi-Agent Networks
How can people and institutions verify which human, organization, agent, or sub-agent is acting; what authority it received; what limits apply; and whether that authority has been narrowed or revoked across a multi-principal agent network?
FID-074
Agent Alignment and Runtime Assurance
How can organizations determine whether AI agents remain aligned with human intent and institutional policy while they plan, use tools, delegate work, and act? What evidence and interventions can reveal and stop consequential deviations before they become failures?
Open question
Open work
Primary need: privacy-preserving AI, agent memory evaluation, data governance, high-trust systems
- Build memory, retrieval, and tool-use evaluation harnesses.
- Review scenarios from privacy engineering, pastoral confidentiality, education, nonprofit operations, and data-governance practice.
- Develop synthetic data generators and leakage metrics.
- Contribute threat modeling and responsible disclosure expertise.