AgentRealm · Research
Your agent remembers. Nobody governs what it kept.
An always-on agent doesn’t just recall — it carries durable state that causes actions later: task ledgers, permissions, credentials, commitments, triggers, audit records. This survey codes 435 works and finds a field fluent in putting state in, and nearly silent on getting it out, revoking it, or undoing what it did.
arXiv:2606.30306 · cs.MA · Ding · Nannapaneni · Liu · Zhang · 435 works, coded four ways
Always-on is not about running constantly.
The survey’s definition: an agent is always-on if its policy at time t depends on state accumulated before t — beyond the current prompt or task instance. The defining property is persistence, not continuous execution.
It’s written to be checked against a system rather than asserted of it. Three conditions classify it.
If the retained state is consequential, the system owes an answer when someone asks why it acted. Four questions, and most systems can answer none of them.
The first three conditions classify a system. This fourth one is an obligation — and it is what the rest of this survey measures.
Memory is one satellite. Persistent state is the planet.
Persistent state is every durable, control-relevant record that crosses the session boundary with the agent — not just the retrievable text most prior work studies. They fail together, so they have to be governed together.
Every durable record has six dimensions. The field measures the safe ones.
Each axis names a question a stored item must answer before it is allowed to move the world. Pillar height is how many of the 435 works touch that axis.
The line between a fact the agent holds and one it is licensed to act on. The rarest axis in the corpus — and the first thing poisoning, privilege drift and cross-user leakage attack.
The survey reports per-axis counts for four of the six. Scope and actionability are named and argued but not separately counted — drawn as dashed spokes rather than invented numbers.
The loop has two arcs. The field only built one.
State is observed, written, validated, organized, retrieved, acted on — then updated, forgotten, audited, rolled back. Sphere size is how many of the 435 works exercise that stage.
No governed criterion for what deserves to become durable. The write captures the value and drops who authorized it.
Three of the five live on the return arc — the arc the corpus shows is least implemented.
Persistence invents its own failure modes.
None of these are hallucinations. Each is a durable record doing exactly what it was stored to do — at the wrong time, for the wrong principal, with no way back. Each names the stage it breaks at and the invariant it violates.
One untrusted line of tool output is promoted into durable memory. It doesn't need to be retrieved today — it waits, and every future session inherits it, long after the attacker's session ended.
budget
More recall is not more competence. Salient-but-wrong episodes crowd out current evidence and drag tool choice off course — in several studies a memoryless baseline simply wins.
A trigger stored under a permission that has since been revoked still fires. Nothing marks the record as expired, so stale state quietly overrides fresh observation.
Delete patches one index; the summary and the embedding that already absorbed the value keep it. Decay-based forgetting is worse — downweighted, present, and still retrievable under the right query.
In shared memory one agent's bad write becomes every agent's premise. Publish-subscribe pools are untyped and unaudited, with no revocation semantics and no one owning cleanup.
The cruel one. Restoring a snapshot can resurrect deleted data and re-grant revoked permission. The operation most likely to re-introduce corruption is the least studied of all.
A bigger context window fixes none of this.
Value is the only field most memory systems represent. Discard the envelope and nothing can recover it — the record cannot say whether it is still authorized, or what it has already caused.
Recall and governance are different capabilities. A text store has nowhere to put a permission epoch, a deletion ledger or a rollback handle — so no amount of reading solves it.
The survey proposes AOEP-v0: a pilot contract that scores state mutation and recovery obligations instead of answer quality, split so a system that stores nothing cannot look safe. Proposed, not shipped.
Databases, distributed systems, formal methods, capability security, machine unlearning. Transactions, compensation, revocable grants, verified erasure — old work the agent stack has not imported yet.
All counts are the survey’s own coding of a 435-work corpus — a scoped map, not an exhaustive census of the field. Last updated: August 19, 2026.