The Write Policy Is the Hard Part: Promotion Pipelines for Agent Memory

Most "agent memory" tutorials stop at the retrieval side. They show you a Qdrant collection, a qdrant-find call, an embedding model, and call it done. Retrieval is the easy 20%. The part that quietly eats your week is the write-path: deciding what deserves to be written, sanitizing it, and keeping the network and RBAC plumbing intact so the agent can actually reach the store it's allowed to write to.

If you run agents that update their own knowledge base, this is for you. The failure modes here aren't AI problems. They're distributed-systems problems wearing an AI costume: a 403 Forbidden on a write, a default-deny-ingress policy that silently blinds an agent to its own memory, a vector store slowly rotting into landfill because nobody gated the writes.

Retrieval is solved. Promotion isn't.

The read-side has good primitives. You embed a query, you search, you rank, you feed the top-k back into context. I've written about the recall half of this before in Cognitive Memory for Agents, where the interesting question is whether you use plain vector similarity or activation-based recall.

Promotion has no such consensus. Every observation an agent makes during a session is a candidate for long-term memory, and almost none of them should be promoted. A single session produces hundreds of transient facts: the value of a variable, a file it read, a command that failed, a user's throwaway comment. Write all of that to a permanent store and you don't have a memory. You have a landfill with a search index bolted on.

So the real design question isn't "how do I store this." It's "what is my write policy, and how do I enforce it without breaking security." That's two problems stacked on top of each other, and people usually only notice the second one after the first one is already leaking noise into their vector DB.

What I tried first: write-everything, filter-later

The obvious first move is to write everything and sort it out at read time. Cheap to build. Every observation goes straight into the vector store, and you rely on similarity ranking to surface the good stuff and bury the noise.

That falls apart for a boring reason: embeddings don't distinguish signal from noise, they distinguish topics from topics. A useless observation that happens to be on-topic ranks just as high as a genuine insight. Search "how do I fix the Longhorn PDB drain issue" and you get back the one real fix alongside six half-formed guesses the agent muttered mid-session and never confirmed. The index is technically working. The memory is useless.

A simple recency window was the second thing I reached for. Keep the last N observations, drop the rest. That's not a memory either, that's a ring buffer. It throws away the rare high-value insight from three weeks ago and keeps the noise from ten minutes ago, purely because noise is more recent. Recency is a terrible proxy for worth.

Both approaches share the same missing piece: there's no decision point where something gets judged before it's written. No gate. The whole thing was reactive. And once you've dumped enough uncurated writes into a store, you inherit a second problem: eviction. Now you need a decay policy to claw back the space, which I covered in Eviction Without Deletion. The cleaner fix is to not let the garbage in during the write in the first place.

The actual solution: a promotion pipeline with a gatekeeper

Treat long-term memory like a production branch. Nothing merges without passing checks. Observations live in a cheap, volatile scratchpad. Promotion to the permanent store is an explicit, gated event, not a side effect of the agent talking.

The pipeline has four stages:

1. Capture into a transient scratchpad (session-scoped, no gating).
2. Score each candidate for importance and novelty.
3. Validate and sanitize (dedup, schema check, strip secrets).
4. Promote the survivors into the durable store with provenance.

At the heart of it sits the gatekeeper. It's not AI magic, it's a function with a threshold. Here's the shape I use:

def gatekeeper(observation, store):
    # 1. Cheap reject: too short, or a known non-fact pattern
    if len(observation.text) < 40 or is_ephemeral(observation):
        return Decision.DROP

    # 2. Score. Importance is explicit, novelty is measured.
    importance = score_importance(observation)      # 0.0 - 1.0
    nearest = store.search(observation.embedding, k=1)
    novelty = 1.0 - (nearest.score if nearest else 0.0)

    # 3. Gate: must clear the bar AND not be a near-duplicate
    if importance < 0.55 or novelty < 0.15:
        return Decision.DROP

    # 4. Sanitize before it ever touches the durable store
    clean = strip_secrets(observation.text)
    if clean != observation.text:
        observation = observation.replace(text=clean)

    return Decision.PROMOTE

Two knobs matter here. The importance threshold controls how strict promotion is. The novelty check is what keeps you from writing the same fact forty times with slightly different wording, which is the single most common way vector stores bloat. A near-duplicate of something you already stored is worth nothing, no matter how important the underlying fact is.

score_importance doesn't have to be an LLM call. I've had good results with a hybrid: a set of cheap heuristics that run on every observation, with an optional LLM tiebreaker reserved for the borderline cases. Cheap signals do most of the work:

def score_importance(obs):
    score = 0.0
    # Fixes, decisions, and root causes are worth keeping
    if re.search(r"\b(root cause|fixed by|the fix was|decided to)\b", obs.text, re.I):
        score += 0.4
    # Concrete, reusable artifacts: commands, configs, versions

if re.search(r"(\bv\d+\.\d+|--?[a-z-]+=|kubectl |sysctl )", obs.text):
    score += 0.25
# User explicitly asked to remember it
if obs.flags.get("user_pinned"):
    score += 0.5
# Pure status chatter is worth nothing
if re.search(r"^\s*(ok|done|running|checking)\b", obs.text, re.I):
    score -= 0.3
return max(0.0, min(1.0, score))

Only when the heuristic lands in the ambiguous band (say 0.4 to 0.6) do I spend an LLM call to break the tie. That keeps the pipeline cheap. Most observations never touch a model. The ones that do are already suspected to be worth the tokens.

Provenance is the stage people skip and regret. When you promote, attach where it came from: the session ID, the timestamp, the tool that produced it, and the importance score that let it through. Later, when a memory turns out to be wrong, you want to trace it back and either correct the source or tighten the gate. Without provenance you have facts floating free of any way to audit them, which is how a confidently-wrong memory poisons every future retrieval.

Then security breaks the whole thing

Here's the part the memory tutorials never mention, because they all run on localhost where everything is implicitly trusted. Move that same agent into a real cluster and the write-path stops working in ways that have nothing to do with your gatekeeper logic.

The classic version: your MCP client talks to a memory server that was fine on localhost, you move the server into an LXC or a pod, and now every write comes back 403 Forbidden. The gatekeeper approved the write. The network rejected it. Those are different layers, and conflating them wastes an afternoon.

A localhost MCP config assumes no auth. It looks like this and works only because nothing is checking:

{
  "mcpServers": {
    "memory": {
      "url": "http://127.0.0.1:8080/mcp"
    }
  }
}

Move that server behind an authenticating proxy and the same config gets a 401 or 403. The fix is to pass a bearer token, and the token must never sit in the file as plaintext. Source it at launch instead:

{
  "mcpServers": {
    "memory": {
      "url": "https://memory.internal.example.com/mcp",
      "headers": {
        "Authorization": "Bearer ${MEMORY_WRITE_TOKEN}"
      }
    }
  }
}

Where MEMORY_WRITE_TOKEN is injected from a secrets manager at process start, not committed anywhere. I run agent tokens through the same two-tier service-account pattern I described in Agent Credential Management: a read-only identity for retrieval, a separate write identity for promotion, so a compromised reader can't corrupt the store. That split matters more for memory than for most workloads, because the read path runs constantly and the write path runs rarely. Give them the same credential and every retrieval carries write authority it never needs.

RBAC tightening is the second way this bites. A lot of default service accounts have drifted toward reader-only roles, which is correct for most agents and silently fatal for one that promotes memory. The agent retrieves fine, scores fine, decides to promote, and the write returns 403. Nothing in the AI layer is wrong. The role binding is missing a verb. If you run least-privilege service accounts (and you should), the promotion identity needs an explicit write grant scoped to exactly the memory namespace and nothing else.

Network policy: the silent blinding

Even with the token and the role sorted, there's a third layer that fails silently: the network policy. This one is nastier because it doesn't return a clean 403. It returns a hang, or a connection timeout, which looks like the memory store is down rather than firewalled off.

If you run default-deny-ingress on your cluster (and for a memory store holding curated agent knowledge, you should), then the Qdrant or memory pod rejects all traffic until you explicitly allow the agent's namespace. Miss that rule and the agent is blind to its own memory. It doesn't error loudly. It just retrieves nothing and promotes nothing, and you spend an hour convinced your embedding model broke.

Here's the allow rule that opens exactly one path, agent namespace to memory store, and nothing else:

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-agents-to-memory
  namespace: memory
spec:
  podSelector:
    matchLabels:
      app: qdrant
  policyTypes:
    - Ingress
  ingress:
    - from:
        - namespaceSelector:
            matchLabels:
              purpose: agents      # only the agent namespace
      ports:
        - protocol: TCP
          port: 6333               # Qdrant HTTP API

That keeps the default-deny posture intact while carving a single hole for the traffic that has to flow. If you want the deeper treatment of default-deny and namespace isolation, I wrote that up in Network Policies with Calico. The point for memory specifically: your write policy is only as good as the packets that reach the store. A perfect gatekeeper behind a closed network policy promotes nothing.

When the automated pipeline fails, promote out of band

Pipelines break. A token expires mid-run, a policy rollout blocks a port, a registry starts rejecting pushes. When that happens and you've got a batch of validated memories that passed the gate but couldn't land, you want a manual promotion path so the work isn't lost.

I keep the scratchpad durable enough to survive a failed promotion. If the write to the durable store fails, the candidates stay in the scratchpad flagged pending_promotion, and a small out-of-band job retries them once the plumbing is fixed. This is the same instinct as importing a container image by hand with ctr -n k8s.io images import when a registry push is blocked: the automated path is preferred, but you never let a transient infra failure eat validated work. Design for the pipeline to fail and leave the survivors somewhere you can replay them.

Why gating at write-time beats filtering at read-time

The deeper reason to gate on the way in, rather than filter on the way out, is that write-time is the only moment you have full context. At promotion time the agent knows the session, the task, whether the user pinned the fact, and whether the command actually succeeded. Read-time has none of that. All read-time sees is an embedding and a similarity score, stripped of the context that made the observation meaningful or worthless.

Filtering late also compounds. Every uncurated write costs you three times: once in storage, once in every retrieval that now has to rank around it, and once when the decay policy eventually has to evict it. Gating early pays all three back. A store of 2,000 curated memories retrieves faster and cleaner than a store of 50,000 raw observations, and it's cheaper to run because you're embedding and indexing a fraction of the volume.

There's a governance angle too. A gated write-path gives you one chokepoint where sanitization happens. Secret-stripping, PII redaction, schema validation: they all live in the gatekeeper, so you can reason about what's in the store instead of hoping nothing sensitive slipped through a thousand scattered write calls. For anyone building agent systems where the memory store might hold customer data or infrastructure detail, that single chokepoint is the difference between an auditable system and a liability. It's the kind of design decision I end up walking clients through when they build agent pipelines that touch real data.

Lessons learned

The thing that surprised me most: the AI part of agent memory is the small part. The gatekeeper is fifty lines. The threshold tuning takes an afternoon. What actually consumes the time is the boundary between the agent and its store, which is pure distributed systems. Tokens, roles, network policy, retry logic. If you come at agent memory from the ML side, that boundary blindsides you, because none of it shows up on localhost.

What I'd do differently: I'd instrument the gatekeeper's rejections from day one, not just its promotions. For a long time I only logged what got written. The far more useful signal was what got dropped and why, because that's how you catch a threshold that's too strict silently throwing away good memories, or a novelty check that's deduping things it shouldn't. A promotion pipeline you can't observe is a promotion pipeline you can't tune.

Two caveats worth stating plainly. First, thresholds are workload-specific. My importance bar of 0.55 works for an infrastructure agent that mostly logs fixes and decisions. A research agent that summarizes papers needs a completely different scoring function, because "novelty" means something different when the whole job is synthesizing new material. Don't copy my numbers, copy the structure and tune the numbers against your own rejection logs.

Second, don't over-engineer the gate before you have traffic. Start with the cheap heuristic and a hard threshold. Add the LLM tiebreaker only when you can point at real borderline cases it would resolve. I've watched people build elaborate multi-model scoring ensembles for a store that had eleven memories in it. The write policy is the hard part, but hard doesn't mean complicated. It means deliberate: a clear decision about what earns a permanent write, and enough infrastructure discipline to keep that decision enforceable once security gets involved.