Memory
Memory access control
Granting collections to Agents, Skills and runs — and the audit trail.
Availability note — these docs describe both working and planned product areas. Account authentication, administrator-managed AIHK/AICA tenant regions and keys, signed-in Composer runs and public Guard scans are connected. Skills, Memory, Agents, Workflows, Apps, billing, the public SDK/CLI and the unified API are previews unless a section explicitly says otherwise.
Roadmap and package-contract reference: this page describes the intended GenCMS runtime. The current deployment persists workspace records and drafts but does not execute marketplace Skills, index Memory for retrieval, publish packages, or run Agents, Workflows or Apps. See the deployed API reference for the routes available today.
Nothing reads Memory implicitly. An Agent configuration selects the collections it may read, and a Skill can only read Memory if its manifest declares memory.read.
Memory access — Marketing Agent [x] Company Knowledge [x] Product Documentation [x] Previous Campaigns [ ] Finance [ ] HR
Organization controls
- Role-based access per collection
- Per-Agent grants, not workspace-wide exposure
- Audit log of what retrieved which source and when
- Retention settings and hard delete
- Export of everything a collection holds
- Planned model-access policy — which approved abilities may receive a collection
The tenant's AIHK/AICA region lock applies to every current AI call. Per-collection model-access rules are planned and are not yet an available control, so do not grant sensitive collections to an Agent until that access is appropriate for the whole tenant.