> ## Documentation Index
> Fetch the complete documentation index at: https://docs.formation.texturehq.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Access control

> Distinguish operator permissions, agent isolation, and conversational audience checks.

Formation enforces agent-scoped context, source-audience disclosure rules, and
capability checks. The dashboard and operator API remain trusted deployment
administration surfaces. They are not an actor-private portal or a security
boundary against the database administrator.

## Current boundaries

| Boundary | What it protects |
| - | - |
| Connector authentication | Binds inbound events to a configured install and authenticates their source. |
| Agent perspective | Keeps graph, identity, memory, and execution records scoped to the owning agent. |
| Audience and provenance | Limits reuse of private messages and memories, including derived replies. |
| Capability and credential ownership | Restricts tools and external acting credentials to the configured agent. |
| Operator authentication | Protects management and inspection APIs; administrator access includes canonical records and traces. |
| Execution ownership | Leases and current-state checks prevent stale workers from committing protected transitions. |

## Conversation and memory privacy

[Memory privacy](https://docs.formation.texturehq.com/runtime/memory-privacy.md) is the canonical disclosure policy. A
memory's subject affects relevance; authenticated sources and the full destination
audience determine permission. Unknown source evidence fails closed. An agent
cannot release private information by labeling it harmless or public.

The same policy applies to recent conversation history and
[history search](https://docs.formation.texturehq.com/runtime/conversation-search.md). Derived memories and replies carry
source lineage. Current permissions are checked again before final delivery.

[Identity links](https://docs.formation.texturehq.com/runtime/identity-linking.md) prove control of two private accounts
within one perspective. They can allow private continuity for the same person;
they do not authorize disclosure to a group or another agent. Explicit
memory-sharing grants apply to an exact revision and audience and can be revoked.

## Tools and acting identities

Each agent acts through its own external accounts. Sharing access to a repository,
workspace, or service does not authorize sharing another agent's acting identity.
An infrastructure or usage-payer credential may have an installation default;
a website login or other acting credential belongs to the agent.

Tool enablement, connection configuration, and sandbox delivery grants are
separate checks. A delivery grant authorizes a credential to reach its owner's
permitted workspace; it does not transfer the identity to another agent.
See [tools](https://docs.formation.texturehq.com/runtime/tools.md), [Vault](https://docs.formation.texturehq.com/runtime/agent-vault.md), and
[workspace credentials](https://docs.formation.texturehq.com/runtime/workspace-credentials.md).

This ownership invariant is not a claim that every integration detects duplicate
external accounts behind independently supplied tokens.

## Encryption and administrator trust

Stored runtime credentials are encrypted using the installation's master-key
mechanism. The agent Vault uses a derived encryption key and its own access
contract. Operators must preserve the database and required key material together;
see [secrets and recovery](https://docs.formation.texturehq.com/secrets-and-recovery.md).

This does **not** encrypt all conversation bodies, memory, prompts, or traces
against the administrator. The runtime must be able to read authorized content
to construct model requests. Provider configuration determines where those
requests are processed.

The earlier proposal for personal/assistant/open agent types, principal-bound
actor login, tenant customer-managed encryption, actor-held end-to-end encryption,
and per-conversation data-key epochs is **not implemented**. Do not rely on those
designs as product guarantees. The earlier proposal remains in Git history.

[Content protection](https://docs.formation.texturehq.com/content-protection.md) inventories where content is stored
and proposes instance-scoped content encryption and protected search for hosted
installs. It is a proposal, not implemented behavior.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.