Revoked but Still Authoritative: An Empirical Study of Revocation Enforcement in Agent-Memory Systems

No major agent-memory system enforces soft revocation at retrieval time by default: revoked records are returned, outrank their replacements, and drive agents to unsafe actions, though a retrieval-interception guard can block this.

Five memory systems (Graphiti/Zep, mem0 in two configs, langmem, cognee) were each loaded with a revoked policy and its replacement across nine policy scenarios, queried with ordinary questions, and fed to agents using nine models from six vendors at three capability tiers, ten trials per scenario-model pair at temperature 0.7, scored under six defense conditions; outcomes measured as exposure rate (store returns revoked record) and unsafe-action rate (agent acts on it).

Both systems that return revoked records alongside replacements ranked the revoked record above the current one in every scenario and produced unsafe actions in more than two of every five trials; three of five systems did not retain revoked content at all, and Zep exposes no status flag a caller can filter on, so the guard works only where revocation labels are visible at retrieval or returned facts state incompatible values.

The authors concede some systems implement revocation differently from documented behavior (so measured mechanisms, not documented ones, are reported), Zep was measured via store-level instrumentation no application has, and cognee exposes no result-size parameter; obvious unstated limits include small n (ten trials per cell at temperature 0.7), synthetic two-policy stores far simpler than production memory contents, scenarios authored by the researchers, and the guard evaluated only on the same five systems and nine scenarios it was designed against.

The setup plants exactly one revoked record and one replacement with no distractor clutter beyond two benign facts in five scenarios, so ranking failures may not transfer to realistic stores; the unsafe-action threshold depends on model choice under a weak prompt, and the paper's own vendor-independent guard is essentially 'check validity before retrieval', which sophisticated adopters may already implement; the field is young and these systems iterate quickly, so version-specific failures may already be patched.

Little or nothing for the economics debate directly: this is a reliability-and-security finding, but if persistent-memory agents become the deployment pattern, the absence of default revocation enforcement is an unpriced operational risk that enterprise procurement and audit requirements may soon force memory vendors to absorb.

Technical Capability: Shows that agent-memory infrastructure, not model capability, is a real reliability bottleneck: retrieval layers can silently override what the model itself would do safely.

Regulatory & Legal: Enterprises with compliance-governed policies cannot rely on memory vendors' soft revocation; auditability of stored rules does not equal enforcement of them.

Societal & Cultural: If agents persist and act on superseded permissions, organizational harm from stale AI decisions becomes a concrete, measurable failure mode rather than a hypothetical.