A city permitting agent walks an applicant through a multi-step application across several browser sessions. Weeks later, an abandoned application unexpectedly resumes with stale form data because the agent's session was left open indefinitely. What should the architect have configured to prevent this?

Session state in an agentic system persists conversation and form-progress context between turns, and if no expiry is configured that state can remain resumable indefinitely, which is exactly the failure described - an abandoned permitting application reviving with days-old data as though nothing changed. The fix is to treat session lifetime as a deliberate configuration choice: set an inactivity timeout so a session that's gone quiet for a defined period is closed or archived, forcing a fresh start rather than a silent resume. A larger context window addresses how much conversation history a model can reason over in a single turn; it has no bearing on when a session should be considered abandoned, and a bigger window would actually let more stale context linger longer. Tightening Agent Identity's write permissions controls what the agent is allowed to change, which is a security boundary, not a lifecycle boundary - a permission-scoped agent can still resume a stale session correctly. Adding reranking by recency belongs to a retrieval pipeline surfacing documents, not to session or memory management, so it doesn't touch this problem at all. The scope caveat: expiry length should match the workflow's real completion window - too short frustrates applicants mid-form, too long recreates the original bug. A concrete check: inspect the session configuration for an explicit timeout value rather than assuming a platform default is safe for a multi-day workflow.