Day 52: Why shared memory becomes a permission problem
Why shared memory becomes an access-control problem in multi-agent systems.
When five agents share one memory, whose mistake becomes everyone's belief?
Shared memory is how agent teams compound knowledge instead of rediscovering it every run. It is also the mechanism by which one agent's wrong conclusion becomes infrastructure, and one user's private context surfaces in another user's conversation.
Both failures have the same root: memory written without zones.
Three tiers, three sets of rules
- Private scratch. One agent's working notes and hypotheses. Unvetted by definition, disposable by policy, readable by nobody else.
- Mission-shared. Knowledge for the current task's crew. Visible to that crew, expired when the mission ends.
- Organisational. Durable facts everyone builds on. Write access is a privilege, and entry requires verification.
Promotion is the control that matters
Moving a note from scratch to organisational memory should be an explicit, attributed, verifiable act — because whatever crosses that line becomes load-bearing for every future run.
Copy-paste promotion is how a guess made in March becomes established fact by June: cited confidently, relied upon by three downstream agents, its origin as an unverified hypothesis long forgotten. Nothing in the system records that it was ever provisional.
That is contamination, and it is far harder to detect than leakage because nothing looks wrong. The fact is stated cleanly. It is simply not true.
The test worth running
For one workflow, list which agent can read and write each piece of state. Then apply a single heuristic: would a human colleague in that role be allowed to see this?
If a support agent would not have access to the customer's payment history, the support agent's AI probably should not either. Role-based access is a solved problem in your existing systems; the mistake is building a parallel, weaker version of it inside the agent layer.
Four properties for every entry
Useful, authorised, attributable, correctable.
Memory missing any one of them is either clutter, a leak, a mystery, or a landmine. The fourth is the one teams forget. If a stored fact turns out to be wrong, something has to update it, and the correction has to win at retrieval time rather than sitting alongside the original.
Closing thought
Shared memory needs boundaries. Memory design is access-control design, and treating it as a convenience feature is how privacy and correctness problems get created at the same time.
Day 52 of 60 Days of Production AI Systems.
Previous: Day 51: Why agents need a shared language
Next: Day 53: Why handoffs need contracts
Day 52 of 60 · Agent Coordination Contracts (chapter 9 of 10)
