Hindsight explained: what an agent can keep between sessions
Operating Hindsight safely: sensitive memories and bank boundaries
Review data handling before a long-lived bank acquires personal or secret information.
What you will learn
- Classify content before retain
- Test separation at the read boundary
- Plan correction and deletion
Before you start
- Python client basics
- A synthetic memory test case and a deployment boundary
Create a small, auditable fixture that records corrections, retrieval misses and costs.
Key takeaways
- Durable memory increases retention obligations.
- Bank IDs need application authorization.
- Recalled text cannot grant tool privileges.
Classify content before retain
A memory service makes information durable. Decide whether a statement contains personal data, credentials or customer material before sending it to retain. The README describes an opt-in Memory Defense policy; opt-in means the operator must enable and verify it for the relevant bank.
A redaction pattern cannot replace data minimization. Test with synthetic secrets, check the resulting stored representation and verify that logs and provider requests do not retain the unredacted value. This review did not execute that test.
Test separation at the read boundary
The project describes bank isolation and per-bank MCP endpoints. In a multi-user system, make the application map each authenticated user to the correct bank, then try unauthorized reads and writes. Never trust a client-supplied bank ID alone as an authorization decision.
Memory retrieved into an agent prompt can carry hostile instructions from prior content. Treat recalled text as data, preserve its provenance and keep tool permissions outside the bank. A bank should not be able to grant itself access by storing a sentence that asks for it.
Plan correction and deletion
Users may change a preference or ask for removal. Document how to find the underlying record and any derived observation or mental model it influenced. A UI deletion button is not enough evidence that backups, logs and model-provider copies follow the same retention policy.
The operational checklist should include restricted ports, secret rotation, backup retention and an incident owner. These are deployment requirements to verify; the source review does not certify the product for regulated data.
Decision guide
| Criterion | Option A | Option B |
|---|---|---|
| Best when | You need predictable behavior and easy auditing | You need adaptive optimization and have reliable telemetry |
| Main risk | May leave performance on the table | Can become difficult to explain or debug |
Implementation steps
- 1
Use synthetic PII to test opt-in defenses.
- 2
Verify each user can access only the intended bank.
- 3
Document correction and deletion across derived records.
Copy-ready example
memory_policy:
bank_owner: authenticated-user
sensitive_input: synthetic-test-only
defense: verify-opt-in
deletion: test-derived-records
network: restrictedFrequently asked questions
Is Memory Defense enabled automatically?
The README describes it as opt-in and per-bank; verify configuration before storing sensitive data.
Does self-hosting keep all memory local?
A hosted model provider can still receive content, depending on configuration.
Sources
- Hindsight / README.mdSource checked 2026-09-26
- Hindsight / hindsight-api-slim/hindsight_api/engine/memory_engine.pySource checked 2026-09-26