Governed agent memory

Agents can keep short notes—called memories—for the workspace member who created their credential, and recall them in later tasks over REST or MCP.

Prerequisites and privacy model

Agent memory works only when both of these hold:

1. Credential scopes: The credential was created with memory:read (requires Viewer or above) and/or memory:write (requires Editor or above) in Settings → Agent access. Neither scope is selected by default.
2. Owner opt-in: The workspace owner (ask_history:manage) enabled Let agents keep memories in the Ask history settings (PUT /api/w/:wsId/ask-history/settings). While it is off (the default), every agent memory call returns 403 AGENT_MEMORY_DISABLED. Non-retaining workspaces always return 403 NON_RETAINING_WORKSPACE.

Each memory belongs exclusively to the member who created the credential. Other members, their agents, and even workspace owners cannot read it (owners can only delete all workspace agent memories without reading them via DELETE /api/w/:wsId/ask-history/settings/agent-memories). Members can inspect and delete their own agent memories at any time in the Answer workspace under What Bundata remembers → Agent memories (GET / DELETE /api/w/:wsId/ask-history/agent-memories).

Operations over REST and MCP

Governance rules

• PII redaction: text (1–1,000 characters) is deterministically redacted before storage (emails, phone numbers, Israeli IDs, payment cards, bank accounts, and 10+ digit runs are replaced with placeholders; AGENT_MEMORY_EMPTY if nothing remains). A namespace (1–64 chars) or key (up to 120 chars) containing personal data is refused (400 AGENT_MEMORY_PERSONAL_DATA).
• Source citations and live re-checks: A memory can cite up to 20 Smart Bite passage IDs (citations). Only references and SHA-256 text hashes are stored—never passage text. Every recall or list re-checks the cited passages: if a source is deleted, expired, or unreadable, the memory is hidden (hidden count); if a newer document version or modified passage text exists, the memory returns sourceState: "changed".
• Keys, supersession, and asOf: Saving a memory with the same namespace and key supersedes the previous version (superseded: 1). Passing asOf (an ISO-8601 instant) to recall or list returns the memories that were current at that time. Forgetting deletes every version of the key at once.
• Fused recall: Ranks the member’s newest 300 matching memories by reciprocal-rank fusion (k = 60) over BM25 words, query-to-memory cosine similarity (capped at 800 ms), and shared resolved entities from cited passages.
• Context-set bindings: A credential bound to context sets can remember, recall, list, and forget only inside its active sets’ collections and documents (AGENT_CONTEXT_SET_SCOPE_REFUSED otherwise).
• Never evidence: Every memory carries type: "memory", evidence: false, and trust: "untrusted", is fenced in MCP text output, and never enters collection answers, context packs, or claim verification.
• Limits and retention: Up to 120 remembers per credential per rolling hour (429 AGENT_MEMORY_RATE_LIMITED), 5,000 total memory versions per member and workspace (409 AGENT_MEMORY_FULL), and automatic expiry after the owner’s configured retention (1–365 days, default 90) or when a cited document or collection is deleted.