The short version
Memory admission is a policy checkpoint on the write path of an AI system's durable memory. Before an observation, preference, or learned procedure is committed to long-term storage, it is evaluated: where did this come from, is the source trusted, is it consistent with what we know, is remembering it even permitted? Only information that passes is admitted. Everything else stays ephemeral or is rejected outright, with the decision logged.
The term adapts admission control, the established name for exactly this pattern in Kubernetes and networking, to the newest system that needs it.
Why the write path matters more than it looks
A prompt injection ends when the context window closes. A memory injection does not. Once a malicious or false item enters long-term storage, it can be retrieved into hundreds of future sessions, shaping behavior long after the original interaction is forgotten. Researchers describe these attacks as temporally decoupled: planted today, triggered weeks later by an unrelated task that happens to retrieve the poisoned entry.
This is not speculative. The MINJA study showed memory injection through ordinary user-level queries, no special access required, with injection success above 95 percent on the agents tested. Follow-on work has catalogued delayed triggers, cross-session persistence, and slow goal-drift attacks that bend an agent's objectives over many tasks. OWASP's agentic security taxonomy now lists memory poisoning among its top risks (ASI06).
The failure modes an admission layer addresses
Poisoning is the sharpest risk, but an ungoverned write path fails in quieter ways too:
- Memory poisoning: adversarial content crafted to persist and steer later behavior
- Malicious persistence: instructions that survive session resets by hiding in memory
- Bad context accumulation: stale or wrong observations compounding over time
- Privacy leakage: personal data remembered without consent, surfacing in the wrong context
- Low-quality memory: trivia crowding out signal until retrieval degrades
- Conflicting observations: contradictory facts stored side by side with no arbitration
- Untrusted retrieved context: web and document content promoted to memory as if the agent had verified it
What admission evaluation looks like
Published defenses converge on a layered design: control what enters memory, protect what is stored, and check again at retrieval. Admission is the first layer and the highest-leverage one, because rejecting a bad write costs almost nothing while removing a bad memory later requires finding it first. A plausible admission pipeline evaluates provenance (which source, which session, which tool), trust (is the source authenticated, is the content self-consistent), relevance (does this belong in durable memory at all), and policy (consent, retention class, data-category rules). The verdict routes the item: admit to long-term memory, keep in working memory for this task only, or reject.
The record of those verdicts is itself valuable. It is the answer to a question enterprises are starting to ask their vendors: how do you know what your agent knows, and can you prove where it learned it?
Where this goes
Databases got transactions. Networks got firewalls. Clusters got admission controllers. Each time, a durable-state system crossed a threshold of value where ungoverned writes became unacceptable, and a control layer with a clear name followed. Agent memory is crossing that threshold now, with the attack literature arriving ahead of the defensive products.
The gap between documented risk and available tooling is where categories get founded. Memory admission is a strong candidate for what this one ends up being called.