Governance and Access Control
Agentic Memory and Context stores agent conversations and the curated memory, facts and preferences, derived from them, and applies access control to every read. An agent retrieves only the data that it’s authorized to see, based on who is asking and whose data it is. This page explains who can read what and what your integration sends so that access control is applied correctly.
Access control is enforced at retrieval time and is enabled by default. You don’t take any action to turn it on. Every read API is governed against the identity in your bearer token.
- Every request carries the identities of the agent and the end user interacting with the agent.
- Standard Data 360 security—object-level (OLS), field-level (FLS), and record-level (RLS)—applies to every operation.
- Conversation data is limited to sessions that the agent participates in. On retrieval, the platform confirms the session’s participants before it returns data.
- A missing or mismatched identity returns no data.
Governance Tokens
Access control is driven by two identity values carried in your JWT bearer token. Together, xid and aid decide whose data is returned and which agent is allowed to see it.
xid—end-user identity: The Individual ID of the end user (external customers) or the user ID (internal employees) that the agent is interacting with.aid—agent identity: The ID of the agent making the request.
Memory Access Patterns
Agentic Memory and Context applies two levels of governance to every read. User-level governance always applies. Agent-level governance is optional and narrows results further.
| Level | What you supply | Required? | If supplied | If omitted |
|---|---|---|---|---|
| Individual / user level | xid (Individual ID) for external customers, or the user ID for internal employees, in the JWT | Mandatory | Returns only memory and conversations where that individual or user participated | Nothing is returned (fails closed) |
| Agent level | aid (agent ID) in the JWT | Optional | Narrows results to data where the agent is also a participant (both user and agent) | No agent filter; results stay at user level (any agent serving that customer) |
How Access Control Works
- Governed operations are read only. Access control applies to conversation list, conversation session, get-conversation, get context, and memory retrieval.
- Participant match. A caller can read a conversation or session only if it’s a participant. A caller matches when
xidmatches or the user ID matches. Ifaidis present in the token, the agent must also be a participant. - Fail closed. No match returns no data.
- Unified individual. If any individual ID within the caller’s resolved unified profile matches the
xid, the platform returns the full data graph. Otherwise, it denies the graph. - Facts and preferences. Curated memory is scoped to the customer (
xid) and is available to any agent serving that customer. It isn’t limited to the agent that captured it. - Structured field security. OLS, FLS, and RLS apply to every read.
See Also
j