Persistent memory is now a default setting. Assistants remember across sessions, enterprise copilots index the shared drive, and retrieval pipelines quietly re-embed whatever landed in the bucket last night. Engineering treats each of these as plumbing. They are product decisions — about what the agent may see, how stale it may be, whose data it may mix, and what it must show when it answers.
The failure pattern rarely looks like a breach. It looks like a confident answer from the wrong source: last year's pricing policy cited as current, one customer's case notes surfacing in another customer's summary, a preference a user stated once becoming a rule the agent applies forever. No one approved any of it, because no one owned the grant. Memory without an owner is a retention policy nobody wrote.
Treat every source, corpus, memory store, and retrieval path as a product surface. Before the grant, write a Context Contract: the allowed sources, a numeric freshness SLA, the isolation boundary (tenant, case, or user), when citation is required, a named owner, and a quarantine path for when a source goes bad. Default is deny. No source without a row. A new corpus, an embedding refresh, or a change to what the agent remembers is a new ship, not a hotfix.
This completes the Agent Ops trio. Autonomy Tiers answer how much the agent may do. The Tool Contract answers what it may touch. The Context Contract answers what it may see, remember, and cite. Many incidents blamed on the model are context failures no eval would catch, because the eval ran against yesterday's corpus. Steal the one-pager and PRD block at productleading.com/kit — declare the tier, contract the tools, contract the context, name who can stop it.