Conversation history is what the model has seen; run state is what the workflow is doing; business truth is what authoritative systems know; memory is selected information retained for later; and a session is a provider or application container that connects turns. Reliable agents model these separately instead of calling everything “memory.”
You will choose where each kind of state lives, design a resumable checkpoint, and prevent stale conversation text from overriding authoritative data.
When a user says “my order is unshipped,” the agent should retrieve current order state. Prior text does not rewrite the ledger.
Encrypt sensitive state, sign or integrity-check it where appropriate, and treat provider references as opaque. Do not serialize live database clients or secrets.
Memory writes are side effects. Require provenance, purpose, confidence or validation, tenant/user scope, expiry, and a deletion path. Prefer explicit facts over generated summaries when possible.
Do not store an agent’s guess that “the user is probably angry” as durable profile data.
Failure injection: Change the ticket in the system of record while a run waits for approval. Resume must detect the stale proposal and require recomputation or reapproval.
Design retention and deletion rules for all five state kinds, including how a user deletion request propagates into provider-managed sessions and redacted evaluation fixtures.