I'm evaluating a major vendor's "AI Agent" SDK. Their demo touts "stateful, memory-aware conversations." Sounds great until you look at the actual session object after a few turns.
It's a data hoarder. By default, it's storing:
* Every raw user input string
* The full parsed "intent" object with confidence scores for *all* possible classifications
* Internal timestamps for each processing step
* The complete chain of tool calls and their intermediate results
This isn't just "session state." It's the entire audit log, and it's being passed back and forth on every request. For a support bot handling sensitive user info, this is a compliance nightmare waiting to happen.
Their documentation says this is "for debugging and continuity." My counterpoints:
* Debug data belongs in logs, not in the active session payload.
* Continuity doesn't require storing every intermediate artifact.
* This increases cost (bigger payloads) and risk (PII surface area).
Has anyone found a way to strip this back to the *actual* necessary state? I'm looking at the session serialization hooks, but they seem designed for addition, not subtraction. The vendor's answer is "just filter it client-side," which misses the point entirely.
Caveat emptor.