Agent Memory Needs a Sandbox and a Diet

An agent that runs across sessions has two ways to fail: it can forget a useful lesson from yesterday, or carry today’s mistake into tomorrow. It can also have more access to the machine than its task needs. Recent engineering work points to these as separate design problems—not something a better prompt alone fixes.

Google Cloud’s November 6 announcement says Agent Substrate reached 1.0 and general availability on GKE. Its design separates stateful agent actors from reusable execution workers; when a session pauses, it snapshots the actor’s memory and files and later restores them to a worker. The post says it restores in under 500 milliseconds and describes gateways that enforce access and inject secrets by actor identity. These are vendor-reported details, not an independent performance test. S1

Persist lessons, not exhaust

Anthropic defines agent memory as knowledge retained between sessions in context the agent can read later—not a transcript, in-context learning, or a compaction summary. In a comparison of one Pokémon Red run apiece at around 10,000 steps, Anthropic reports that Sonnet 3.7 had 413 memory files across 225 folders; Fable 5 had nine files in two folders plus a top-level index. The smaller set focused on strategies and plans rather than state the game already displayed. Anthropic also found that fixed rules for what to remember could weaken memory’s benefits for the models it evaluated. S2

The practical implication: persist what will be hard to reconstruct—verified decisions, tested procedures, and the current goal—and fetch volatile state fresh from the application. Store provenance and a verification date alongside uncertain facts. That provenance advice is an engineering recommendation, not a feature Anthropic claims to have tested.

Make access part of the runtime

Memory hygiene cannot contain a bad tool call. Agent Substrate’s actor/worker split and identity-bound gateway controls suggest a useful design seam: agent state can persist while compute stays disposable, and credentials can be supplied by the trusted boundary rather than written into an agent’s notes. Start with a sandbox that has only the files, network endpoints, and tools the task requires; gate irreversible writes separately. That reduces the blast radius if the model’s plan goes off course.

This is also an organizational problem. Y Combinator’s Gumloop profile describes employees building agents over existing tools while IT controls security, data access, and costs. S3 Small teams can apply the same split locally: task owners specify workflows, while the platform controls authorization, secret delivery, quotas, and audit logs. A reusable agent is production software, so its memory should be inspectable and its privileges revocable.