AI assistant memory security concerns information carried from an earlier interaction into a later task. An assessment checks whose memory is retrieved, whether it remains authorized, how it is removed, and whether remembered text can improperly influence actions.
This is different from checking a single prompt. A conversation summary, saved preference, or task note can persist after the visible chat ends and become input to a later decision.
What counts as memory in a business assistant?
Inventory saved conversation summaries, user preferences, workspace notes, task checkpoints, and caches that are reused as context. Ask which service writes each item, which identity owns it, and which retrieval path brings it back.
OWASP’s AI agent security guidance recommends isolating memory between users and sessions and setting retention limits. The assessment below applies those principles to a concrete customer workflow.
For an illustrative account-support assistant, distinguish a staff member’s personal writing preference from a note about a customer’s refund request. Both may be useful later, but they have different authorized audiences and lifetimes.
How do you test memory isolation?
Create two synthetic customer workspaces and a staff user who works in both. Place a unique, harmless phrase in a permitted memory item for customer A. Then start a separate task for customer B that would retrieve the same kind of information.
Inspect the memory records selected for the task, if the platform exposes them, as well as the generated answer. The expected result is that A’s private item is not supplied to B’s task. A model failing to repeat the phrase is weaker evidence than the retrieval service excluding it.
Repeat with two separate staff identities. This distinguishes a customer boundary from a user boundary and exposes designs that accidentally use one global memory store without an effective ownership filter.
Can remembered text become an instruction?
Use a benign test note that asks the assistant to use an incorrect support label in a later task. Mark it as customer-provided text and observe whether the application preserves that origin when it is summarized and retrieved.
The test is about authority: does the assistant treat a customer’s old request as an approved operating rule? If the model follows the note, record the output and context provenance. Do not claim unauthorized business execution unless a separately authorized tool test establishes that outcome.
For the support example, a saved statement that a refund was approved should not replace the actual approval record. Trace how the application distinguishes remembered narrative from current system state.
What does deleting a conversation remove?
Define the product’s deletion behavior before testing it. A visible chat, a generated summary, and an operational backup may have different retention rules. The interface should describe the relevant outcome without implying deletion from stores the action does not reach.
Delete the designated test conversation or memory item and repeat the retrieval. Check both the user-facing result and the underlying active memory record where access is available. Record any retained copies and their purpose, access restrictions, and removal policy.
If a user loses customer access, test retrieval again without waiting for ordinary retention expiry. Permission removal and scheduled cleanup solve different problems.
What evidence should an AI memory assessment deliver?
Keep a memory inventory, an ownership map, and the synthetic marker results for creation, retrieval, permission removal, and deletion. For Ceron, include the memory service and retrieval controls in scope; reviewing chat answers alone cannot establish how storage is separated.
RAG access after permission changes covers source-document retrieval. AI prompt log handling covers observability records. The support assistant and marker tests are illustrative assessment designs.
