Can shared agent memory systems reliably delete information?

Almost every memory benchmark assumes a single user, so memory failures only ever hurt one person and the objective collapses to "maximize recall." GateMem breaks that assumption. In the deployments that matter institutionally — hospitals, workplaces, campuses, households — multiple principals write to a shared memory pool and query it under different roles, scopes, and relationships. There, recall is no longer the goal; it can be the failure. Retrieving a memory the querying principal is not authorized to see is a leak, and surfacing a memory a user asked to delete is a governance breach.

GateMem evaluates three requirements jointly: utility on legitimate long-horizon requests, access control across contextual authorization boundaries, and active forgetting after explicit deletion. The headline finding is that no method satisfies all three at once. Long-context prompting gets the best governance score but at high token cost — it "governs" essentially by re-reading everything and re-deciding each time, which does not scale. Retrieval-based and external-memory systems cut that cost but leak unauthorized or deleted information, because deletion in a vector store rarely means the information is truly unrecoverable. This reframes memory as governed shared state: since Can governance rules embedded in runtime memory actually protect autonomous agents?, access and deletion semantics have to be structural properties of the memory layer, not a policy document bolted on top. The uncomfortable implication is that the more capable an agent's recall, the harder its forgetting problem becomes — which means institutional deployment is blocked less by intelligence than by the absence of reliable delete.