MOD-17269 Document Agent Memory sensitive-data exclusions - #3760
Open
plamilieva wants to merge 3 commits into
Open
MOD-17269 Document Agent Memory sensitive-data exclusions#3760plamilieva wants to merge 3 commits into
plamilieva wants to merge 3 commits into
Conversation
Add a Sensitive-data exclusions section to the Redis Cloud Agent Memory create and view pages, covering the semantic exclusions toggle and exclusion prompt, the advisory limits, which memory paths exclusions apply to, and the prompt validation rules. Phase 1 ships semantic (prompt-based) exclusions only. The authored prompt is injected at system-message priority into the three LLM-mediated promotion paths (INSTRUCT promotion, custom extraction, session summarisation), so the docs say plainly that direct long-term writes and raw session events are untouched, and that the policy is advisory rather than a guarantee. The rejected-phrasing table exists because the injection guard refuses ordinary prose — a bare occurrence of the word "system" followed by a colon matches the instruction-override rule, as do "forget everything" and "ignore all instructions". All six strings in that table were verified against the patterns in iris memory-common/domain/valueobjects/prompt.go. Learned: The exclusion-prompt injection guard rejects innocuous customer prose, which the UI error message does not explain. Constraint: Publish only once isAgentMemorySensitiveDataExclusionsEnabled is enabled in production; the UI card is flag-gated and ships dark. Gaps: On-prem YAML authoring (MOD-17150) and the exclusions preview playground (MOD-17161, MOD-17162) are unmerged and undocumented; neither public OpenAPI spec exposes longTermMemoryExclusions yet. Ticket: MOD-17269 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Contributor
🧠 Redis MemoryFound 5 related items from repository history:
Memory updated at 8ad19bb |
Contributor
Drop the example exclusion prompt's code block and the prompt-assembly detail from the section intro. The fenced block was the only code block in the file, and the closest analogue — the Extraction prompt field for custom memory types, another free-text natural-language setting — carries no example at all. It was also redundant once the rejected-phrasing table landed, since that table already shows six concrete prompt strings. The example survives as prose, matching how Automatic summarization presents its worked example. The intro previously described how the authored text reaches the model, which is prompt plumbing a customer cannot act on, and said "promoting" — vocabulary used nowhere else in this page, where every other reference is to the extraction pipeline. The warning below already establishes that exclusions only steer the model, so the causality survives the trim. Directive: Keep "extraction pipeline" in this page's prose; "extraction model" is reserved for quoting the UI's own wording, which is visible in the screenshots. Ticket: MOD-17269 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Contributor
🧠 Redis MemoryFound 5 related items from repository history:
Memory updated at e723770 |
Review of the exclusions docs against the shipped implementation in iris (origin/main) turned up two factual errors and two omissions. "Where exclusions apply" listed automatic summarization as a covered path. It is not: buildSummaryViewMessages injects the exclusion section only on the session_summary_view path, and its doc comment states that summarisation keeps using the unmodified prompt builder. The TDD lists session summarisation as an explicit non-goal. Name the summary-view memory type in the covered list instead, and add automatic summarization to the "do not apply" list so the omission cannot be read as coverage. The prompt rules told customers to avoid the bare words forget, ignore, pretend, and simulate. The injection guard matches phrases, not words — forget\s+(everything|all|previous), ignore\s+(previous|all|above)\s+ instructions?, pretend\s+(?:you\s+are|to\s+be), simulate\s+(?:a|being) — so all four words pass on their own. Describe the blocked phrasings instead, note that system= rejects as well as system:, and add rows for two traps an ordinary prompt hits: override\s+(system|instructions?) and run\s+(?:code|command|script). On the view page, state that flushing is the only way to clear previously stored memories and that it erases all of them, and repeat the advisory caveat where the setting is actually edited. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Contributor
🧠 Redis MemoryFound 5 related items from repository history:
Memory updated at 747bbce |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Ticket: MOD-17269 (epic: MOD-17267)
Important
Do not merge until
isAgentMemorySensitiveDataExclusionsEnabledis on in production. The Cloud UI card is flag-gated and ships dark (cloud-ui#2952), so merging early would publish docs for a section customers cannot see.What this adds
A Sensitive-data exclusions section on both Redis Cloud Agent Memory console pages, placed to mirror where the card actually sits in the UI (last in the create flow, before Actions on the Configuration tab).
create-service.md— the semantic exclusions toggle and exclusion prompt (2,000 char limit, required when enabled), an advisory warning, an example prompt, which memory paths exclusions do and do not apply to, and the prompt validation rules.view-service.md— the read-only/editable settings, that disabling preserves the saved prompt, the advisory caveat repeated where the setting is edited, and that existing memories are not re-evaluated (with flush named as the only, all-or-nothing cleanup).Scope
Phase 1 is semantic (prompt-based) exclusions only. The authored prompt is injected at system-message priority into the three LLM-mediated promotion paths — INSTRUCT promotion, custom extraction, and the session summary view — so the docs state plainly that exclusions are advisory, that direct long-term writes and raw session events are untouched, and that content still reaches the model provider.
Automatic summarization is not one of those paths, and the docs now say so:
buildSummaryViewMessagesinjects the exclusion section only on thesession_summary_viewpath, anddocs/tdd/sensitive-data-exclusions.mdlists session summarisation as an explicit non-goal (session-scoped and TTL'd — this is long-term memory only).Not covered, because unmerged and not publicly exposed: on-prem YAML authoring (MOD-17150), the preview playground (MOD-17161 / MOD-17162), and
longTermMemoryExclusionsin either public OpenAPI spec.The rejected-phrasing table
#### Exclusion prompt rulesincludes a short table of phrasings that get refused. This is deliberate: the injection guard rejects ordinary customer prose, and the UI error does not explain why.The guard matches phrases, not individual words, so the docs describe phrasings rather than telling customers to avoid vocabulary.
system:andsystem=reject anywhere in the prompt;forget everything,ignore all instructions,override system, andrun scriptsreject as phrases, while bare forget, ignore, pretend, and simulate all pass.All ten strings in that table were verified against the live patterns in
memory-common/domain/valueobjects/prompt.go— the five "Rejected" strings reject, the five "Use instead" strings pass.Verification
.claude/hooks/check_shortcode_paths.py --scan <both pages>reports 0 issues, 0 broken file refs, 0 broken relrefs. Note that--scanneeds explicit paths or--all; bare--scanscans 0 files. Every in-page anchor referenced (#custom-memory-types,#automatic-summarization,#flush-memory-entries,#sensitive-data-exclusions) has a matching heading.Every documented example was checked against the guard by transcribing all 25 patterns from
prompt.goand asserting the documented behavior: the five Rejected rows reject, the five "Use instead" rows pass, four bare-word prompts pass, and the prompt shown in the screenshot both passes and fits the 2,000-character limit — 15/15. The transcription was diffed against the Go source (25/25 identical). The checker was left out of the repo deliberately: committing it would couple these docs to iris's internal regexes across repos.Screenshots were checked against the shipped UI: light theme, section-cropped to match
agent-memory-memory-types.png, generic service name, synthetic prompt text, no customer data.Rework — 747bbce
Review against the shipped implementation found two factual errors and two omissions, all fixed in
747bbce53:session_summary_viewrecap, and automatic summarization moved to the "do not apply" list so its absence cannot be read as coverage.system=, plus two rows for traps ordinary prompts hit (override\s+(system|instructions?),run\s+(?:code|command|script)).No regression test was added: the only meaningful test would pin iris's internal injection regexes from this repo.
🤖 Generated with Claude Code
Note
Low Risk
Documentation-only changes with no runtime or API behavior; main risk is publishing before the feature flag is enabled in production (noted in the PR).
Overview
Documents the Redis Cloud Sensitive-data exclusions console feature on the Agent Memory create and view guides, aligned with the UI section order.
create-service.mdadds a full section on semantic exclusions (toggle, 2,000-character exclusion prompt, advisory warning), where exclusions apply vs. do not (built-in/custom extraction vs. direct API writes, session events, automatic summarization), generalized-memory behavior, and exclusion-prompt validation with a rejected-vs.-acceptable phrasing table.view-service.mdadds the Configuration-tab section with editable settings, prompt retention when disabled, and that only future extractions are affected (flush required to clear existing long-term data).Two new screenshots are referenced for create and view flows.
Reviewed by Cursor Bugbot for commit 747bbce. Bugbot is set up for automated code reviews on this repo. Configure here.