What is session state?
Session state is the record of where a conversation or a task has reached, held so that it can resume correctly. It carries the entitlements resolved for the asker alongside the steps already completed. Memory is what a system retains about a person over time, where session state is what it needs to continue the current exchange.
Why a resumed conversation is a security boundary as much as a convenience
The problem appears the first time a user returns to a conversation after lunch. Whatever the system retained has to be correct about where the exchange had reached, and also correct about who is now asking, because entitlements may have changed in the interval. Deployments that store state as a transcript get the first part right and the second part wrong. State held as a transcript also grows until retrieval starts answering the question from two turns ago.
- A resumed task repeats or skips a step unless its progress is recorded explicitly.
- Entitlements resolved at the start of a session expire during a long conversation.
- State kept as an ever-growing transcript degrades retrieval on later turns.
- An abandoned session holds material that retention policy has to account for.
How session state works
- The elements worth retaining are specified rather than the whole transcript.
- Each session is identified and scoped to the authenticated person who opened it.
- Resolved entitlements are stored with an expiry and revalidated on resumption.
- Completed steps are recorded so a resumed task continues from the right point.
- Older turns are summarised or discarded under a stated policy as the session grows.
- Sessions expire and their contents are deleted on the schedule retention requires.
How session state is evaluated
Session state is tested by interrupting a conversation and resuming it under changed conditions. Examine the following across real sessions:
- correctness of the resumed step after an interruption
- proportion of sessions revalidating entitlements on resumption
- retrieval accuracy on later turns compared with the first
- growth in stored state per turn against the retention policy
- rate of sessions expiring and being purged as configured
Limitations, risks and common failure modes
- State is stored as a full transcript, so the model answers an earlier question.
- Entitlements resolved at sign-in persist after the user's access has been withdrawn.
- A session identifier shared across browser tabs mixes two unrelated tasks.
- Abandoned sessions accumulate indefinitely and hold material beyond its retention period.