The agent keeps the diary; a human holds the eraser

Your agent product gives every customer a persistent memory. The agent saves what it learns with POST /api/v1/agent/memory/items, recalls it with hybrid search, and walks its own relation graph between projects. After six months the store has duplicates, contradictions, and facts about a vendor the customer dropped in March.

The fix is consolidation: merge, prune, rewrite. And consolidate is human-only. An autonomous caller gets 403 human_only every time, with no flag to self-approve. The agent can add to its memory. It cannot run the pass that decides what its memory should have been.

That's the line you want. A prompt injection that persuades the agent to "clean up" old instructions can write a new item, but it can't reach the operation that rewrites the record.