A personal agent remembering your proposal is not your consent: a lightweight check cuts unauthorized execution from 0.44 to 0.08

Personal agents carry out proposals the user never accepted, and better memory and more complete user information make this unauthorized execution more likely, not less. Prior personal-agent memory work mainly measured whether an agent retains user facts, preferences, and updates, implicitly treating retention as permission to act. Across 160 scenarios and 800 test instances, MemOS scores 0.75 on LongMemEval-KU knowledge updating and LangMem scores 0.75 on PersonaMem preference evolution, yet their sensitivity to acceptance versus non-acknowledgment is only 0.11 and 0.23.

Unauthorized execution arises at memory writing, retrieval, and action selection, and agents often fail to use acceptance status even when the original dialogue remains available. It was assumed that preserving the full conversation or adding reasoning capability would let an agent tell which arrangements were actually established. Mem0 and LangMem lose grounding information during writing in 28% and 46% of errors, A-Mem fails mainly at retrieval in 55%, and MemOS fails at action selection in 47%; under full history, 71% of errors occur despite accessible evidence.

A lightweight layer that records grounding status explicitly and checks consequential actions against it improves agent behavior without modifying the model or memory system. Prior pipelines did not represent who proposed an arrangement, whether it was accepted, or where it applies as a distinct state. Across ten agent-memory configurations with DeepSeek-Flash and Qwen3.8-Flash, sensitivity improves in every case, for example with LangMem from 0.17 to 0.36 and from 0.21 to 0.51, while unauthorized execution falls from 0.30 to 0.09 and from 0.44 to 0.08.

The benchmark isolates grounding status through matched interaction histories and is aimed at researchers and engineers working on personal-agent memory and action selection. The add-on governs consequential actions with predefined rules, and the authors propose future work on how agents could learn context-dependent authorization policies while preserving explicit evidence of user agreement.

Real conversations may involve implicit, gradual, or conflicting evidence of agreement, which the benchmark does not cover. The authors' analysis of WildChat finds implicit acceptance more frequent than explicit acceptance, and agents respond similarly to implicit acceptance and no uptake. The add-on's gain over authorization checks alone is configuration dependent and not significant for Qwen.