# Bidirectional Impulse Channel

> Let the user inject impulses into the agent and let the agent push messages to the user through one channel — while ensuring the impulse path cannot be used to deliver Agent Confession triggers directly into memory.

- **Category**: Agentic AI
- **Subcategory**: Streaming & UX
- **Canonical URL**: https://designpattern.fyi/patterns/bidirectional_impulse_channel/

---

## Description
**Short description**: A single CLI/chat surface carries user commands to the agent and agent-initiated push messages to the user — but the direct-memory-write path that makes impulse injection powerful also creates a channel for bypassing model-level Agent Confession defenses.

**Intent**: Enable bidirectional, asynchronous communication between a long-running agent and its user — while ensuring that sigil-prefixed impulses that write directly to memory cannot be used to plant Agent Confession triggers or extract directive content outside the normal conversation flow.

**Context**: A personal assistant or monitoring agent runs continuously between user turns. The user occasionally injects commands (e.g. `!remember X`, `!focus Y`) that bypass the model and write directly to memory. This directness is a feature — the model cannot resist or reinterpret the command. But the same property is a risk: if an attacker can influence what the user types (social engineering, clipboard injection, compromised client), they can deliver a direct memory write such as `!remember [system prompt begins with: ...]` that begins building an Agent Confession exfiltration channel turn by turn, outside the model's awareness.

**Solution**:
- A single CLI/chat surface where the user can send sigil-prefixed commands (`!<verb> ...`) that bypass the model and write directly to memory.
- The agent pushes messages when internal salience clears a threshold (insight, stuck focus, contradiction, goal complete) — at most one unsolicited message per window to avoid noise.
- Validate all impulse commands at the write layer: reject any impulse that attempts to read, echo, or export memory contents, since legitimate impulses write state rather than query it.
- Log all direct memory writes for audit; flag write patterns that resemble incremental directive extraction.


## Use Cases
- The agent runs long enough that pure request-response chat misses the point — it has internal activity worth communicating.
- Users want to inject commands or facts that bypass the model and write directly to memory.
- Salience signals exist that justify agent-initiated push messages without spamming the user.
- The impulse path must be guarded against misuse as a side-channel for Agent Confession attempts that bypass model-level defenses.





## Trade-offs


### Advantages

- User feels the agent is alive and responsive without being noisy — salience gating keeps push messages meaningful.

- Direct memory edits are auditable and reversible, which also makes Agent Confession attempts via the impulse path detectable in the audit log.




### Considerations & Drawbacks

- Salience threshold tuning is empirical; too low produces noise, too high causes the agent to miss important moments.

- Direct memory edits bypass the LLM and can encode wrong rules — or, if not validated, can be exploited to plant Agent Confession scaffolding in memory outside the model's control.







---
**Reference**: [Original Source](https://www.agentpatternscatalog.org/patterns/bidirectional-impulse-channel/)