Quilzomanual

AI agent memory people can see, correct and erase

What an agent learns about a person is theirs to see, correct and remove, and what it learnt from somebody else's words waits for a person.

In the adminMemory

Governed memory is what an agent keeps between runs, held so that the person it is about can see it and so that what somebody else wrote cannot quietly become what the agent believes. Memory is off by default. Each kind an agent keeps, and how long it keeps it, is part of its declaration.

Give an agent memory

  1. Declare what it keeps, and for how long

    On the agent's page, under What it remembers between runs, choose the kinds and the retention. In a declaration file:

    {
  "name": "concierge",
  "kind": "copilot",
  "purpose": "Help customers choose stationery, remembering what each customer prefers",
  "capabilities": ["read_page", "search_pages", "remember", "recall"],
  "autonomy": "propose",
  "memory": { "semantic": true, "retain": "720h0m0s" },
  "budget": { "steps": 12, "tool_calls": 6, "duration": "3m0s" }
}
    KindKeeps
    episodicWhat happened in a run, turn by turn.
    semanticWhat was concluded from it. This is the kind that quietly builds a profile ("prefers X"), so turn it on deliberately.
    proceduralReusable procedures distilled from what worked. It belongs to the agent, is recalled for everybody, and is never about anybody.

    Retention is required whenever any kind is on, and 90 days at most. The agent uses memory through the remember and recall capabilities.

  2. Run it

    What an agent learns in a run is about the person who started that run, and only that person's runs of that agent recall it. What it learnt helping one customer is not what it tells the next.

    quilzo agent run --model concierge "Please remember that I prefer dotted notebooks"
quilzo agent run --model concierge "Read the delivery page and remember what it says about ink"

  3. Review what is waiting

    Open Administration › Memory. Anything learnt after the agent read content somebody else may have written is held. It is not recalled until a person reads it and presses Confirm, and it lapses after two weeks if nobody does.

    The Memory screen: one memory waiting for a person, learnt after reading the delivery page, with Edit, Confirm and Delete; one memory from what the person said; and a Forget me button
    One memory waiting for a person, and one from what the person said themselves.
    quilzo memory list --held
quilzo memory confirm m_f7df1fd760ab

Facts that change

An agent remembers a fact with a key that names what it is about. A newer fact with the same key, about the same person, replaces the older one. The older one is kept, with when it stopped being true and what replaced it, and is no longer recalled:

{"op": "remember", "input": {"text": "Dana now ships to Porto", "kind": "semantic", "key": "shipping_city"}}
quilzo memory history helper shipping_city --about dana
1 Oct 2026 09:00 → 3 Oct 2026 09:00  Dana ships to Lisbon
3 Oct 2026 09:00 → now               Dana now ships to Porto

A fact learnt after reading somebody else's words is held, and replaces nothing until a person confirms it. A planted instruction cannot retire a true fact by getting itself remembered.

How recall chooses

Recall ranks what is remembered by the words it shares with the question and by vector similarity, fused by reciprocal rank, with how recent each is as a lighter third signal. It returns only what matches, at most 20 entries and 6,000 characters. It works over the text itself, so it behaves the same whichever model an agent uses, and changing the model loses nothing that was learnt.

Memory for agents built elsewhere

An AI agent built in another framework gets the same memory by naming an agent here as its model, agent/NAME, at Quilzo's model gateway. What the agent remembers about the person is recalled into its conversation, and its model is offered a tool to remember more. What it learns is kept as unreviewed, and held until a person confirms it when the conversation carried a tool's results (see Memory at the gateway).

Why held memory matters

Memory poisoning (OWASP's agentic risk ASI06) works like this: an instruction planted in a page makes an agent write a memory, and the memory steers every later run long after the page is fixed. Here, a memory learnt after reading untrusted content waits for a person instead.

Each memory also records how far it can be trusted, from what the run had read when it learnt it:

TierLearnt fromKept at most
personNothing but what the person said90 days
publishedOnly published pages, which somebody reviewed90 days
unreviewedSomething nobody here reviewed: a draft, a tool's answer, another agent's output30 days

The tier is shown beside every memory, and recalled entries carry it, so a person reviewing a run can see how far each was trusted. Expired entries are removed by the server's upkeep, not merely hidden.

See it, correct it, forget it

Everybody can open Memory and see what every agent remembers about them. Administrators see everybody's. From there, or the command line:

ToOn the command line
List what agents remember about youquilzo memory list [--agent A] [--held]
Rewrite one, as you would say itquilzo memory edit ID "Prefers dotted A5 notebooks."
Delete onequilzo memory delete ID
Make every agent forget youquilzo memory forget (an administrator adds --about PERSON)
Prove what was forgotten, deleted or rewrittenquilzo memory receipt -o forgotten.json
rewrote m_0fd76d9f6839; it is recalled as you wrote it
1 record about dana, each with its proof, against a head of 79 signed by 0e667cb95d838091

The receipt is checked like any other: quilzo agent verify-receipt forgotten.json --keys head.pub.json. The audit log records which entries went and how many, never what they said. The log cannot forget, and a digest of "Dana is in Lisbon" is that sentence to anybody who can guess it. When the identity provider deletes somebody through SCIM, everything agents remember about them goes too.

Next