Skip to main content
Formation enforces agent-scoped context, source-audience disclosure rules, and capability checks. The dashboard and operator API remain trusted deployment administration surfaces. They are not an actor-private portal or a security boundary against the database administrator.

​
Current boundaries

​
Conversation and memory privacy

Memory privacy is the canonical disclosure policy. A memory’s subject affects relevance; authenticated sources and the full destination audience determine permission. Unknown source evidence fails closed. An agent cannot release private information by labeling it harmless or public. The same policy applies to recent conversation history and history search. Derived memories and replies carry source lineage. Current permissions are checked again before final delivery. Identity links prove control of two private accounts within one perspective. They can allow private continuity for the same person; they do not authorize disclosure to a group or another agent. Explicit memory-sharing grants apply to an exact revision and audience and can be revoked.

​
Tools and acting identities

Each agent acts through its own external accounts. Sharing access to a repository, workspace, or service does not authorize sharing another agent’s acting identity. An infrastructure or usage-payer credential may have an installation default; a website login or other acting credential belongs to the agent. Tool enablement, connection configuration, and sandbox delivery grants are separate checks. A delivery grant authorizes a credential to reach its owner’s permitted workspace; it does not transfer the identity to another agent. See tools, Vault, and workspace credentials. This ownership invariant is not a claim that every integration detects duplicate external accounts behind independently supplied tokens.

​
Encryption and administrator trust

Stored runtime credentials are encrypted using the installation’s master-key mechanism. The agent Vault uses a derived encryption key and its own access contract. Operators must preserve the database and required key material together; see secrets and recovery. This does not encrypt all conversation bodies, memory, prompts, or traces against the administrator. The runtime must be able to read authorized content to construct model requests. Provider configuration determines where those requests are processed. The earlier proposal for personal/assistant/open agent types, principal-bound actor login, tenant customer-managed encryption, actor-held end-to-end encryption, and per-conversation data-key epochs is not implemented. Do not rely on those designs as product guarantees. The earlier proposal remains in Git history. Content protection inventories where content is stored and proposes instance-scoped content encryption and protected search for hosted installs. It is a proposal, not implemented behavior.