An AI agent with memory is a database nobody governs

ChatGPT remembers what you do across applications. Meta shipped an agent that sits on your laptop and reads what is there. The coverage of both focused on capability.

My job for the last several years has been making sure data has an owner, a trail, and rules about who can touch it. Looking at these products through that lens, I see a database that arrived without any of it.

The reframe

An agent with persistent memory across your applications and read access to your files stores data about you. It stores that data somewhere, for some duration, accessible to some set of parties, with some deletion behaviour.

That is a data system. Every question you would ask of a production database applies.

Most companies piloting these tools cannot answer a single one of those questions. Not because the answers are hard, because nobody was assigned the question. Procurement treated it as a productivity tool, and productivity tools do not go through data review.

Where it lands

The failure will not look like a breach. It will look like a subject access request that nobody can fulfil because the agent memory store was never inventoried. Or a departing employee whose agent retained six months of context from a system they lost access to in March. Or a regulator asking which processor holds the conversation history and getting three different answers from three teams.

None of that is an AI problem. Those are governance problems wearing a new label, and the teams that ignore them will find out through an audit rather than a design review.

What to ask before the pilot

Who is the data owner? A named person, not a team. Shared accountability produces no accountability.

What is the retention policy, and can you enforce it? Vendor defaults are not a policy. Confirm whether you can set retention and whether deletion propagates to derived state such as embeddings.

What is the deletion path? Deleting a conversation and deleting what the system learned from it are different operations. Ask which one you get.

What is the classification of the data it can reach? An agent with filesystem access inherits the sensitivity of everything in reach. If it can read a folder containing customer records, the agent is now in scope for whatever regime covers those records.

Where does the audit trail live? If you cannot reconstruct what the agent read and when, you cannot answer any question an investigator will ask.

I asked my network who owns this conversation inside their company. The responses split between the data governance team and nobody yet, with nobody yet taking about a quarter. That is a small sample from one professional network, so weight it accordingly. The pattern matches what I see in practice.

The organisations that get this right are not the ones that move slower on AI. They are the ones that ran the agent through the same review they would run a new warehouse through, because it is the same kind of thing.