When should an agent memory be scoped per-session, per-user, or globally?

## Scope is a property of the memory, not of the query The single most useful framing: every stored memory carries the scope it was written at, and that scope determines who can ever see it. If scope is only applied at read time as a filter, then every new read path is an opportunity to forget it — and forgetting it once means one user's private fact surfaces in another user's session. Making scope a partition key, so that a query without a scope simply cannot return rows, converts a discipline problem into a structural one. ## The three common tiers **Session scope.** State belonging to the conversation or task in progress: the plan, tool results, a temporary instruction such as "keep answers short for now". It should expire with the session. The mistake here is promoting transient instructions into durable preferences — an agent that permanently believes you want terse answers because you once said so in a hurry is a familiar annoyance. **User scope.** Facts about a specific person or account that should persist: language, units, role, plan tier, recurring goals, things learned from past sessions. This is the tier most agent products actually need, and the tier with the strictest privacy obligations, since it is personal data with retention, export and deletion requirements attached. **Global or organization scope.** Knowledge that is true independent of who is asking: a runbook, a schema description, a policy, a shared glossary. In multi-tenant systems this usually splits again — organization scope shared within one customer, and a true global tier shared across all of them. The distinction matters because customer-specific knowledge escaping to a global tier is a data-leak incident, not a quality regression. Agent scope is a fourth tier worth mentioning in multi-agent systems: knowledge belonging to one specialist role rather than to any user. ## The promotion path Memories should move outward through tiers only as evidence accumulates, and the bar should rise at each step. A single observation in one session is exactly that — an observation. Repeated across several sessions for the same user, it becomes a candidate user fact; the repetition is the evidence that it reflects a stable preference rather than a moment. Promotion beyond the user to organization or global requires a different kind of justification entirely: not "many users do this" but "this is true regardless of user". Frequency across users is weak evidence, because it can encode a majority preference as a universal rule and quietly degrade service for the minority. In practice, promotion into a global tier is where human review belongs. It is cheap to review because it is rare, and the cost of getting it wrong is paid by every user simultaneously. ## Blast radius and reversibility Size the guardrails by blast radius. A wrong session memory costs one conversation and dies on its own. A wrong user memory costs one person and persists until corrected, which is why users should be able to see and delete what the agent believes about them. A wrong global memory costs everyone and is the case worth engineering against: provenance recorded on write, a review step before promotion, and the ability to revoke a single promoted memory without rebuilding the store. ## Demotion, expiry and deletion Scope is not only a widening path. Facts can narrow, too — knowledge that turns out to be team-specific should drop out of the global tier rather than being patched with exceptions. And scope determines deletion semantics: a user-scoped memory must be removable when that user is deleted, which is much harder if their facts have already been folded into a global summary. That is a concrete reason to keep tiers physically separate rather than merging them for retrieval convenience. ## What interviewers are listening for They want to hear that you would not write everything at the widest tier because it is convenient, that you can articulate the promotion evidence bar, that you treat scope as enforced structure rather than a hint, and that you have thought about deletion and multi-tenancy before being asked. Saying plainly that a global memory tier is optional — that many successful agent products ship with session and user scope only — signals judgment rather than architecture-for-its-own-sake.