Episodic Memory at the Gateway Seam

For a while, the gateway tried to decide — in the middle of each request, as the response streamed through it — which sentences deserved to become durable organizational knowledge. Per-exchange extraction scored every response and filed candidates into the review queue. It worked exactly as designed, and that was the problem: it proposed roughly 700 entries a day, humans reviewed approximately none of them, and the pending queue's TTL quietly deleted the overflow. A pipeline built to capture judgment was capturing guesses nobody checked, then discarding them on a timer.

Turning per-exchange extraction off was not a retreat from memory. It was an admission that the judgment sat at the wrong end of the pipe. This post is the architecture that replaced it — the Memory pillar from our framework for operating LLMs safely, rebuilt around a distinction brains have used all along: episodic memory is not semantic memory, and the promotion from one to the other is where governance lives.

Write-time judgment asks a machine to guess, mid-request, what an organization will need to know next month — and asks a human to check the guess seven hundred times a day. Read-time judgment captures first, decides later, and caps how much deciding a day is allowed to demand.

Why write-time judgment fails

The moment a response streams through the gateway is the worst possible moment to decide whether it matters. Durability is a property you can only observe in retrospect: does the same fact recur across sessions? Does anyone reach for it again? At write time none of that signal exists, so an extractor compensates the only way it can — by proposing generously. Every borderline sentence becomes a candidate, because discarding it feels irreversible and proposing it feels free.

But proposing is not free. The proposal's cost is paid downstream, in the scarcest currency the system has: human attention. A review queue fed 700 candidates a day is not a control, it is a formality — and a formality with a TTL is worse than no queue at all, because expiry deletes the backlog silently. Nothing was reviewed, nothing was deliberately forgotten, and the system could not even say which was which.

The fix is not a better extractor. It is moving the judgment from the moment of capture to the moment of reading. Capture becomes cheap, private, and total; judgment becomes scheduled, budgeted, and grounded in what was actually captured. The rest of this post walks that loop end to end — everything below is shipped and running, not a roadmap.

Episodic memory is not semantic memory

The replacement starts with a second store. Alongside the knowledge base — the semantic store of approved, searchable facts — the gateway keeps an episodic record: every exchange and every tool call that flows through it becomes an episode.

Episodes are deliberately modest objects. An exchange episode holds a bounded digest of the user's message and the response — capped, with an explicit truncation marker when cut — not the raw payload. A tool call becomes an execution event with a bounded input and, when it arrives, a bounded result. Four properties do the governance work:

• Owner-private. An episode belongs to the person whose request produced it. It is not team-visible, not searchable by anyone else, and never injected into anyone's prompt — including its owner's.
• Sanitized at capture, fail-closed. PII sanitization runs at the capture seam itself, independent of whatever the proxy pipeline already redacted. Episodes carry placeholders, never raw values — and if sanitization fails, the capture is dropped. A failed scan never stores raw text.
• Bounded retention. Episodes expire after 90 days by default, pruned on a schedule. The episodic store is a working record, not an archive.
• Forward-only. Capture records what happens after it is turned on. There is no backfill and no retroactive mining of old traffic.

Because an episode can never reach a prompt, capturing everything is safe in a way that extracting everything was not. Episodes are raw material. Nothing in the episodic store is knowledge yet.

Reflection with a budget

Promotion from episodic to semantic memory happens once a day, through a reflection pass with a hard cap: at most eight lessons a day. The reflector reads the last few days of an owner's episodes and distills the durable, cross-session lessons it finds — and every lesson must cite the specific episodes it derives from. A proposal that cannot ground itself in cited episodes is discarded, not stored. No citation, no candidacy.

Each surviving lesson lands exactly where a deliberate save would: pending and private, in the same human review queue that governs every other write to the knowledge base. There is no reflection-only approval path and no bypass. Near-duplicate guards keep the pass idempotent — a lesson that duplicates approved knowledge, or the reflector's own still-pending proposal from yesterday, is skipped rather than re-filed.

Eight is the load-bearing number. It is small enough that a person actually reads the queue each morning, which means approval regains its meaning: an approved lesson has genuinely been judged, and the citation trail shows what it was judged against. The old pipeline optimized for recall and lost the reviewer. This one budgets for the reviewer and lets recall be a read-time problem.

Recall that admits what it doesn't know

Episodes earn their keep at read time. From Claude Desktop or Claude Code, the team-brain MCP server exposes recall_episodes: a search over your own episodic record — exchanges, tool runs, or both, over a chosen window. The dashboard offers the same search without an MCP client. Both surfaces are owner-clamped: recall only ever returns the caller's own episodes, the same boundary enforced at capture.

And when nothing matches, recall says so. An honest empty result is a design choice: a memory surface that pads its answers trains its users to distrust every answer. The Visibility pillar applies to memory too — what the system knows, and the edge of what it knows, should both be inspectable.

Execution memory: a timeline, not a rerun

Tool calls get a second read-time surface. An executions timeline reconstructs each session step by step — which tools ran, in what order, with what inputs, and what came back — from the captured execution events. It answers the question audits actually ask: what did the agent do, exactly, and when?

The timeline exports a replay in the archival sense only. The export is non-executable — a structured record for inspection and audit, not a script. It never re-runs a tool, replays a request, or touches a live system. Reconstruction and re-execution are different capabilities, and conflating them would turn an audit artifact into an attack surface.

The review ceremony: a share gate as ritual

Approval makes a lesson real; it does not make it shared. A reflected lesson a reviewer approves is still private to its owner — the same two-gate model that governs every entry in the knowledge base. The second gate deserved better than a checkbox, so it became a ceremony.

The dashboard turns each member's approved private lessons into a meeting agenda. In one sitting, the team walks the list and batch-decides each item: share it to the team brain, keep it private, or archive it. The actions are owner-only — nobody can share a lesson on someone else's behalf — and a shared lesson carries its owner's attribution with it. Items nobody rules on carry over to the next ceremony rather than expiring, because the old pipeline already taught us what silent expiry costs.

This is the Trust pillar made social. The share gate stops being an administrative afterthought and becomes a short, recurring ritual where the team decides together what the shared brain learns — with a named owner behind every entry that crosses the line.

Bounded forgetting

Learning loops that only add eventually drown in their own history, so forgetting gets the same treatment as remembering: a budget and a human. Once a week, a decay pass flags at most five approved entries that look idle — never injected, not retrieved in months — for review. A human confirms each flag: keep the entry and clear it, or quarantine it out of active use. Quarantine is reversible, and nothing is ever deleted autonomously. The system proposes forgetting; people do it.

What this adds to AI memory governance

We wrote earlier about governing what your AI remembers: pending-by-default review, durable tombstones for rejections, scoped reads, idempotent injection. The learning loop composes with all of it, and the composition is what makes the memory-poisoning story hold.

Trace the path an adversary would need. Text planted in a conversation becomes, at most, an owner-private, PII-sanitized episode — unreachable by search or injection. To go further it must survive the reflection pass, where the grounding guard discards anything that cannot cite real episodes. What survives lands pending and private, behind human review. A rejection tombstones the content so it cannot creep back through the queue. An approved entry that later looks wrong can be quarantined — reversibly, by a person. Every gate the planted text must pass is one a human can see, and the two that matter most — approval and sharing — are ones a human must operate.

That is the trade in one sentence: the gateway remembers everything it sees, privately and briefly — and learns only what a person, reading a small cited digest each morning, decides is worth keeping.