Compliance requirements for agent work history
2 Jul 2026 · 7 min read
Agent work history can include personal data, business secrets, decisions, approvals, and derived memory.
Work history is both operational evidence and governed data. It needs retention, deletion, export, and access policy.
AstraRunner treats this as an execution-platform concern: the run needs durable state, traceable decisions, cost visibility, and enough structure for teams to review what happened after the agent finishes.
Patterns that work
- Classify traces, artifacts, tool outputs, and memories.
- Apply retention by data class and risk.
- Support deletion propagation into derived memory.
- Keep audit records for policy decisions.
Implementation checklist
- Define data inventory for agent runs.
- Add access controls to artifacts.
- Implement retention jobs.
- Test right-to-forget flows.
Watch outs
- Derived memory can survive after source deletion.
- Debug artifacts often contain sensitive context.
- Compliance exports need stable identifiers.
Related reading
How this fits the Astra stack
AstraRunner owns the operational path for agent work: orchestration, scheduling, approval gates, traces, costs, and role-agent handoffs. AstraMemory owns durable context and retrieval. AstraGenie turns those capabilities into product workflows for teams that want automation without rebuilding the platform layer.