An agent handles both general technical questions (public information) and proprietary architecture discussions (classified as internal confidential). Within a single session, the conversation transitions from a confidential architecture review back to answering general technical questions. A security review flags the risk that confidential architecture details could surface in the general-audience responses. Which memory management practice BEST mitigates this risk?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Think of classification boundaries like a clean room — you don't carry contaminated material back out. Option A is correct: flush the memory context when crossing down from a higher classification to a lower one. The agent should treat each classification level as its own isolated memory domain, never carrying confidential context into a public response.
Full explanation below image
Full Explanation
The correct answer is A. When a conversation crosses from a confidential context back to a public or lower-classification context, the accumulated memory from the confidential phase must be cleared. This prevents the model from inadvertently referencing, paraphrasing, or being influenced by confidential architecture details when answering general questions. The principle is analogous to a security clearance compartment — information from one compartment does not flow to another. In practical implementation, the agent detects the classification transition event and invokes a memory flush before proceeding in the lower-classification domain.
Option B is wrong because labeling and instructing the model to avoid referencing high-classification entries is a soft control that relies on the model's instruction-following behavior. Models can and do blend context from across their context window, even when instructed not to. A label-based approach does not provide a hard boundary — it is a behavioral guardrail, not an architectural isolation. Security engineers refer to this class of failure as 'context bleed.'
Option C is wrong because encryption is an access control for data at rest or in transit, not a memory isolation mechanism. An encrypted entry that is decrypted and loaded into the active context window when 'in confidential mode' still lives in the same context as the public-mode conversation history. Encrypting entries does not prevent them from influencing the model's outputs if they are in the same prompt context.
Option D describes a valid architectural pattern (separate agents per classification), but the question specifically asks for a 'memory management practice.' Using separate agents is an infrastructure design decision, not a memory management technique. It also does not address the scenario as stated, which involves a single session transitioning between contexts.