Unit 08.03: Persisting a session safely

A persisted session is a store of personal data. Being built for convenience does not change what it holds.

Retention, access, deletion

The record carries a creation date and a retention period, so age is computable and purging is mechanical.

The code prints a session record and checks it against its retention period.

import json
from datetime import date

record = {
    "user_id": "user-a",
    "session_id": "s-1",
    "created": "2026-07-01",
    "last_used": "2026-07-29",
    "retention_days": 30,
    "messages": [{"role": "human", "content": "why was I charged twice?"}],
    "extracted_facts": {"account": "ACC-1187"},
}

age = (date(2026, 7, 29) - date.fromisoformat(record["created"])).days
print(json.dumps({k: v for k, v in record.items() if k != "messages"}, indent=2))
print(f"\nage {age}d against {record['retention_days']}d retention: "
      f"{'PURGE' if age > record['retention_days'] else 'keep'}")

print("""
A persisted session is a store of personal data: the conversation, the account
number, and whatever the user typed. It needs a retention limit, access control
and a deletion path, exactly like any other such store -- being built for
convenience does not exempt it.
""")

The record holds the conversation, an account number, and whatever the user typed - which may be anything. That is the same category of data as your primary store and needs the same three controls: a retention limit, access control, and a deletion path someone can actually invoke.

Note that the messages are excluded from the printed summary. Operational views of a session store should not casually display its contents; the metadata is enough to manage it.

The mistake this prevents

Long-term memory - facts deliberately persisted across sessions rather than within one - raises two questions a session store does not. Did the user agree to being remembered between visits, and how do they correct a fact the system has stored about them wrongly? Both need an answer before the feature ships, because a wrong remembered fact is more durable than a wrong answer: it shapes every future session until someone can change it.

The mistake is treating session storage as a cache. Caches get built without retention policies, replicated for performance, and excluded from deletion tooling because nobody thinks of them as a data store. A conversation history is not a cache.

Takeaway

Give persisted sessions a retention limit, access control and a deletion path. A conversation store holds personal data regardless of what it was built for.

Mark complete