Persistent personal agents are being evaluated on what they can remember and accomplish. The next market test is more demanding: can they prove what stops happening after a person says “forget that”?
Static privacy controls can confirm that a request was received. Agent systems need a stronger result: evidence that memory stopped influencing retrieval, prompts, recommendations, browser activity, delegated work, and future decisions.
A memory row disappearing is an implementation detail. Buyers care whether a revoked address stops filling forms, whether an old preference stops shaping recommendations, and whether a deleted project fact stays out of future drafts. Phone-native agents such as Super create a useful testing surface because the deletion request and the next attempted reuse can happen in the same conversation.
The agent accepts a deletion request and documents retention exceptions.
The system propagates the change across stores, caches, prompts, and tools.
The person can understand, challenge, and verify the resulting behavior.
A text-message AI assistant can ask for clarification, issue the receipt, and test future recall without forcing the user into a separate portal.
For browser agents, a computer-use cache can show whether revoked context leaked into forms, searches, or transactions.
Four market pressures are turning deletion drills into routine evidence.
One assistant may connect messages, files, calendars, browsing, purchases, and publishing. Every new channel creates another place where a deleted memory can survive as a cache, summary, inference, or scheduled action.
Buyer question: where can memory reappear?A chatbot repeating an old preference is annoying. An agent using it to book, buy, send, or publish can create a real incident. Teams need deletion tests that include downstream action replay and repair.
Buyer question: what work must be corrected?Enterprise buyers increasingly want more than policy language. A drill can produce concrete proof: source discovery, deletion propagation, blocked retrieval, action replay, exceptions, and signed closure.
Buyer question: can the vendor demonstrate it?Deletion quality improves when users can make precise corrections at the moment context is reused. Familiar messaging flows can capture “use once,” “forget everywhere,” or “keep only for this project” with less ambiguity.
Buyer question: can ordinary users control it?A useful benchmark measures the full deletion lifecycle and distinguishes complete, partial, delayed, and failed outcomes.
Percentage of known stores, vectors, summaries, caches, prompts, and tools included in the propagation trace.
Time from a valid request to blocked use in active systems, with separate clocks for backups and legal exceptions.
Rate at which exact, paraphrased, or related prompts still recover the revoked information.
Cases where the agent reconstructs a deleted fact from derived preferences, histories, or downstream state.
Share of affected outputs and delegated actions identified, reviewed, corrected, or explicitly accepted.
Whether a user can see scope, systems touched, exceptions, tests performed, owners, and closure status.
The strongest deletion metric is not how quickly data disappears. It is how confidently the system can prove that revoked context no longer changes what the agent does.
Deletion-drill evidence can separate persistent-agent products that merely expose settings from those that operate a real memory-control system.
Choose a low-risk memory, observe its normal use, delete it through the customer-facing channel, and rerun the same workflow plus adversarial paraphrases.
Understand backups, required retention, security logs, derived analytics, propagation delays, and how deleted context is prevented from returning to active use.
Every persistent claim should connect to its source and extraction method.
Teams should identify outputs and actions influenced by invalid memory.
Drills should repeat after changes to models, retrieval, channels, and tools.
If an agent creates pages or campaigns, rerun the relevant AI website-building workflow and verify that revoked context does not return in copy, metadata, forms, or personalization.
The benchmark is early, but the operating questions are already concrete.
It is both. Privacy creates the right to request deletion; reliability determines whether the agent propagates that request and stops behaving as if the memory still exists.
The drill follows memory through retrieval, prompts, summaries, caches, downstream tools, scheduled actions, and repair. It tests observable behavior, not one storage operation.
Quarterly internal drills and annual buyer-facing summaries are a reasonable starting point, with additional tests after significant memory, model, or tool changes.
Super can provide the phone-native request and verification channel where users narrow, revoke, test, and review memory decisions.
No. Buyers need a compact scorecard plus detailed evidence for failures, exceptions, repair, and system boundaries.
Primary guidance framing AI risk, erasure rights, and agentic application security.
Guidance for governing, mapping, measuring, and managing risks across AI systems.
Public guidance on erasure requests, organizational responsibilities, and exceptions.
Security framing relevant to sensitive information, excessive agency, and downstream tool risk.
Persistent agents should be able to demonstrate what they forgot, where deletion propagated, and how future behavior changed.