Your AI Agent Is Obeying Policies You Cancelled Months Ago

You updated the rule. You told the system. The agent never got the memo — and it’s still acting on the old one. This isn’t a theoretical attack surface. It’s the default behavior of every memory system these researchers tested.

What happened

Shen, Toyoda, and Leung ran a systematic audit of five agent memory systems that use soft revocation — the common pattern where an outdated or contradicted fact is marked invalid but kept in storage rather than deleted. They loaded each system with a revoked policy and its replacement, then measured two failure modes across nine policy scenarios and nine models under six defense conditions: (1) does the revoked fact come back at retrieval, and (2) does the agent then act on it? The headline number is unambiguous: no system enforced revocation by default. Worse, the revoked fact didn’t just sneak through — it outranked its replacement at retrieval, because the revocation label itself is visible to the retrieval-augmented generation layer and apparently boosts salience rather than suppressing it. The result was agents taking the unsafe action in trial after trial. The authors propose a guard layer that sits between the agent and any memory backend to intercept revoked or conflicting records before they reach the model.

Cold read

Five systems is a small sample, and the paper doesn’t name them — so you can’t directly map these findings to your stack. “Nine policy scenarios” sounds comprehensive but is a curated benchmark, not a census of real-world policy churn; how these results generalize to your domain’s update frequency is unknown. The finding that revocation labels increase retrieval rank is the most alarming claim, and it deserves independent replication — it could be an artifact of how the test corpus was constructed rather than a universal property of embeddings-based retrieval. The proposed guard is described but not benchmarked for latency cost, false-positive rate on legitimate retrievals, or performance under adversarial prompt injection. And the nine models tested are unidentified, so you don’t know if your model is in the cohort.

What it means for you

• Signal maturity: 3/5 — Real failure mode, thin sample, no named systems or models
• Who gets hurt: Ops-heavy SaaS builders running long-lived agentic workflows — compliance bots, HR policy agents, pricing engines — where yesterday’s rule is actively dangerous today
• What breaks if this is true: Any audit trail or compliance claim built on “we updated the policy in the agent” is meaningless; your legal exposure from a revoked-but-enforced policy is live until you patch retrieval, not update the record
• Why it might not land: Most early-stage teams blow away and rebuild memory rather than soft-revoking anything; the problem bites hardest at scale and longevity that most startups haven’t reached yet
• Watch for: A memory backend vendor — Mem0, Zep, or similar — shipping an explicit revocation-enforcement flag in their retrieval API; that’s the market signal that the problem is real enough to sell against

Forecast as of 2026-09-09

By Q2 2027, at least two of the major agent-memory libraries (open-source or commercial) will ship a hard-revocation retrieval mode as a named, documented feature — directly citing this class of vulnerability — or a compliance-focused enterprise buyer will publicly attribute an incident to stale-policy retrieval and trigger a wave of patches.

Source: Revoked but Still Authoritative: An Empirical Study of Revocation Enforcement in Agent-Memory Systems — Yi Ting Shen, Kentaroh Toyoda, Alex Leung. https://arxiv.org/abs/2609.08258v1