Give persistent agents a reviewable memory layer.

Start at the deployment boundary.

The local core runs offline without an LLM. Your first evaluation can use local files and SQLite in a controlled environment. Optional model providers, storage adapters, and network services change the data boundary and should be reviewed separately.

For shared organization workflows, the repository includes a PostgreSQL-backed Hub and Docker Compose, Kubernetes, Helm, and cloud deployment assets. These are self-hosting starting points, not a managed-service availability promise.

Choose an initial deployment around the information your agent is permitted to retain. Confirm backups, deletion, secret management, and operator ownership before admitting real sensitive data.

Connect access to memory use.

Local memory records carry scope and visibility information. The Hub adds organization identity, OIDC SSO, SCIM provisioning, roles, audit export, retention controls, and configuration for customer-held key services.

A local MCP stdio process inherits the caller’s OS access. A network gateway token and the Hub’s tenant model are different boundaries. Choose the model that matches your trust requirements instead of treating all interfaces as interchangeable.

Scope labels are not a substitute for a sound identity deployment. Validate the exact credentials, role mappings, default policies, and backend behavior used in your pilot.

Make recurring guidance a reviewed change.

Lesson activation uses content-bound review receipts. The operator can configure two-person review and human-required approval. Those settings matter: independent review is not an unconditional default in every local store.

Screening detects known patterns for secrets, personal information, and prompt injection. Detection and optional redaction reduce particular risks; they do not establish that arbitrary memory is safe or free of sensitive data.

Policy promotion and rollback retain an explicit evidence path. Use these controls alongside your existing incident handling and human escalation procedures.

Test one agent workflow.

A useful pilot begins with one repeatable workflow and one outcome your team can verify. Coding-task completion, reviewed support resolution, or another bounded business result can be a starting point; the right choice depends on your traffic and risk.

Agree which memories are eligible for withholding and which instructions must remain protected. Record every assignment and outcome. Check integrity before interpreting any change in results.

The deliverable is a decision: continue collecting evidence, revise the memory, withdraw it, or investigate the workflow. Timing and sample requirements depend on traffic and effect size; there is no guaranteed one-week answer.

• One named workflow and a responsible operator.
• A data boundary and explicit access policy.
• A stable, independently checkable success definition.
• A plan for missing outcomes, harmful results, and rollback.