Persistent memory can boost personalization in large language model (LLM) agents, but it also risks sycophancy and cross‑domain leakage. We separate governance into two decisions: admission, which decides what recalled information enters the working context, and presentation, which decides how that information is expressed. To address these without retraining, we implement two inference‑time designs:
- Factor‑Compiled admission (FC) evaluates whole memory entries;
- Permission‑Semantic admission (PS) decomposes entries into typed units and translates adjudicated attributes into eligibility decisions via deterministic policies.
We evaluate on a development suite covering four backbone models and an external benchmark comprising four tasks with 300 samples each. Compared with verbatim injection, FC and PS reduce the pooled judge‑assessed failure rates on the external benchmark by 6.7 and 8.8 percentage points (p = 2.7e‑7 and 4.1e‑12), and cross‑domain leakage on the development set drops by up to 29.5 points. A query‑conditioned gating baseline shows no significant change in objective‑fact failures or pooled failures. Under matched admission budgets, PS outperforms random and relevance‑based selection on external objective‑fact judgments after Holm correction. Holding presentation fixed, tightening admission further cuts cross‑domain failures by 17.5 percentage points (p = 1.6e‑4); in contrast, comparisons between two renderings of identical adjudicated outputs do not survive multiple‑comparison correction.
Both designs increase personalization failures, and PS misses the preregistered improvement and personalization‑preservation criteria. These findings support evaluating admission and presentation separately: selection quality yields task‑specific safety gains, while preserving beneficial memory use remains an open problem.
Review