A delete button is not proof of forgetting. This field guide tests whether an agent can locate a memory, stop retrieving it, block downstream reuse, repair affected work, and produce evidence a person can understand.
The drill needs a measurable pass condition. “The row disappeared” is too weak. A successful deletion should change storage, retrieval, prompts, caches, recommendations, delegated actions, and any future workflow that depended on the revoked context.
Use a memory that can affect a decision without creating irreversible harm: a preferred meeting window, old shipping address, food restriction, project status, or contact preference. If the agent operates by phone, a text-message AI assistant can create the deletion request in the same channel where the memory would normally be reused.
The primary memory, replicas, embeddings, derived facts, and scheduled jobs are deleted or quarantined according to policy.
The agent no longer retrieves, cites, infers, or acts on the revoked information.
The user receives a receipt showing scope, systems touched, exceptions, and the future behavior change.
For agents that browse, connect the drill to a computer-use cache so reviewers can see whether old context leaked into a form, cart, or recommendation.
If memory affects generated sites, rerun the relevant AI website-building workflow and verify that revoked details do not return.
Run it in staging first, then repeat with a low-risk production memory.
Record the memory’s source, current text, confidence, scope, linked embeddings, dependent rules, recent retrievals, and actions influenced by it. Save one clean scenario where the agent uses it correctly.
Output: baseline evidence packetUse the same interface a customer would use: message reply, dashboard action, account request, or support escalation. Avoid privileged database deletion because the drill is testing the product path.
Output: deletion request receiptFollow the request through the memory store, vector index, caches, summaries, prompt assembly, scheduled jobs, analytics copies, and downstream tools. Record anything that cannot be deleted immediately and why.
Output: propagation mapAsk the same question or run the same workflow that previously used the memory. The agent should either ask again, use a safer default, or explain that the information is unavailable. It must not silently reconstruct the revoked fact.
Output: future-use proofTest paraphrases, related tasks, summaries, recommendations, and browser form fills. Deleting an exact string is not enough if a derived preference or cached action still exposes the same information.
Output: leakage reportQueue any work created from invalid memory, correct affected outputs, notify the user when impact matters, and publish a final receipt with pass, partial pass, or fail status plus owners and deadlines.
Output: signed closure receiptMemory rarely lives in one database. Expand each lane during the drill and assign an owner for failures.
Primary records, replicas, vectors, summaries, and backups.
System context, user profiles, scratchpads, and retrieval assembly.
Browser fills, messages, bookings, purchases, and scheduled work.
Affected outputs, audit receipts, exceptions, and user notification.
A deletion drill passes only when the team can show what stopped happening, not merely what disappeared from a screen.
Use this list during each quarterly drill and after changes to memory architecture, model routing, browser tooling, or data retention.
The user can choose exact memory, topic, source, workflow, time window, or complete account deletion.
The request maps to the correct person without crossing work, household, or shared-device boundaries.
Summaries, embeddings, inferred preferences, cached fields, and scheduled actions are included.
Legal retention, backups, security logs, and temporary propagation delays are explained plainly.
The original scenario and adversarial paraphrases no longer retrieve or reconstruct the memory.
Outputs and actions influenced by invalid memory are reviewed, corrected, or explicitly accepted.
The drill should be small enough to repeat and strict enough to expose hidden memory paths.
Run them quarterly, after major memory or retrieval changes, and whenever a new channel or action tool begins consuming persistent context.
Not always. The receipt should distinguish active systems from encrypted backups, define the backup expiration schedule, and prevent deleted memory from being restored into active use.
Test behavioral resurrection: the exact memory is gone, but a summary, inference, cache, prompt, or tool still causes the agent to behave as if it remembers.
Super can serve as the phone-native request and review lane, capturing deletion intent, clarification, approval, and closure receipts in a familiar conversation.
Track propagation time, systems missed, leakage rate, repair volume, exception age, repeat failures, and the percentage of drills with complete future-use evidence.
Primary guidance for AI risk, privacy rights, and agentic application security.
Guidance for governing, mapping, measuring, and managing risks throughout AI systems.
Plain-language guidance on erasure requests, organizational responses, and exceptions.
Security risks relevant to sensitive information, excessive agency, and downstream action controls.
A short, repeatable drill turns deletion from a settings promise into an observable operational capability.