How Memory Assets Are Registered and Managed Using Fixed Binding + ACL in TencentDB Agent Memory

TencentDB Agent Memory registers every knowledge fragment—from Chat Memory to CodeGraph data—as a Memory Asset, enforcing access control through Fixed Binding metadata that scopes visibility by Team, User, and Agent, supplemented by ACL entries that grant granular permissions when visibility is set to restricted.

In the TencentCloud/TencentDB-Agent-Memory repository, the Memory Hub acts as the central authority for asset retrieval. According to the source code, when an agent or user queries the system, the Hub applies a deterministic two-stage filter: first matching Fixed Binding attributes, then evaluating ACL permissions. This architecture ensures that agents only access contextually relevant and authorized knowledge.

Understanding Memory Asset Metadata

Every Memory Asset in the system carries two critical metadata groups that define its accessibility scope.

Fixed Binding Attributes

The Fixed Binding metadata deterministically binds an asset to a specific execution context. As documented in README.md (line 59), this layer defines:

• Team: The organizational unit that owns the asset (empty denotes global scope)
• User: Optional individual owner for private assets
• Agent: Optional specific agent identifier for automatic loading
• Visibility: The access level—private, team, or restricted

During the initial filtering phase, the Memory Hub narrows the candidate set by requiring the requester's Team, User, and Agent IDs to match the asset's Fixed Binding fields. Only assets satisfying these criteria proceed to the next validation stage.

ACL Permissions

When an asset's visibility is set to restricted, the system evaluates the ACL (Access Control List). This fine-grained layer specifies read, write, or share permissions for individual users, roles, or agents. The ACL operates as a secondary filter, ensuring that even if the Fixed Binding matches, the requester must hold explicit permission to access the asset.

The Registration Architecture

The architecture diagram in MemoryCore/openclaw-plugin/docs/architecture.md (lines 21–28) illustrates how the binding and ACL layers sit between the OpenClaw plugin on the client side and the Gateway on the server side. When an asset is created via the Memory SDK, the Gateway persists the asset together with its binding and ACL metadata, ensuring that subsequent queries enforce these constraints at the storage level.

During retrieval, as stated in the project documentation: "Memory Hub uses Fixed Binding + ACL to determine which assets a given Agent can use: first narrow the permission scope by Team, User, Agent, and visibility, then retrieve based on the current query" (README.md, line 59).

Registering Assets with Fixed Binding and ACL

The @tencentdb-agent-memory/memory-sdk-ts-v2 package provides the TypeScript interface for asset registration. The AssetBinding and AssetACL types—defined internally in files such as MemoryCore/src/utils/manifest.ts—enforce the metadata structure at compile time.

Below is a complete example demonstrating how to create a Wiki asset with restricted visibility and custom ACL entries:

import { MemoryClient, AssetBinding, AssetACL, Permission } from '@tencentdb-agent-memory/memory-sdk-ts-v2';

// Initialise the client (gateway URL is configured elsewhere)
const client = new MemoryClient();

// 1️⃣ Define Fixed Binding
const binding: AssetBinding = {
  // The team this asset belongs to (empty = global)
  teamId: 'team-42',
  // Optional user‑level binding – only this user can see it if visibility is 'private'
  userId: 'user-123',
  // Optional agent‑level binding – this agent will automatically load the asset
  agentId: 'agent‑foo',
  // Visibility controls the first‑stage filter
  visibility: 'restricted'   // ← must go through ACL for access
};

// 2️⃣ Define an ACL (only needed for 'restricted' visibility)
const acl: AssetACL[] = [
  {   // Give a specific user read‑only access
    type: 'user',
    id: 'user‑456',
    permission: Permission.READ
  },
  {   // Grant a role read‑write access
    type: 'role',
    id: 'role‑qa',
    permission: Permission.READ_WRITE
  },
  {   // Allow another agent full control
    type: 'agent',
    id: 'agent‑bar',
    permission: Permission.FULL
  }
];

// 3️⃣ Create the asset (e.g. a Wiki page)
await client.createAsset({
  assetId: 'wiki‑intro‑001',
  kind: 'wiki',               // one of: 'chat', 'skill', 'wiki', 'codegraph'
  content: '## Introduction …',

  binding,                    // <-- Fixed Binding
  acl                         // <-- ACL (effective only for 'restricted')
});

The MemoryClient forwards this request to the Gateway, which validates the binding structure and persists the ACL entries alongside the asset content.

Retrieving Assets with Context-Aware Enforcement

Read operations automatically respect both the Fixed Binding and ACL layers. When searching assets, the SDK implicitly includes the caller's context identifiers:

// Retrieve assets visible to the current context (team/user/agent)
const assets = await client.searchAssets({
  query: 'introduction',
  // The client internally sends the caller’s team/user/agent IDs
});

The retrieval process follows strict precedence rules:

1. Fixed Binding Filter: If the caller's Team, User, or Agent IDs do not satisfy the asset's binding constraints, the asset is omitted before ACL evaluation.
2. ACL Evaluation: If the asset passes the binding filter but carries restricted visibility, the system checks whether the caller appears in the ACL with appropriate Permission levels (READ, READ_WRITE, or FULL). Absence from the ACL results in exclusion.

The OpenClaw plugin (MemoryCore/openclaw-plugin/index.ts) registers the hooks and tools that invoke these SDK methods, ensuring that all agent memory operations adhere to the security model defined by the repository's architecture.

Summary

• Memory Assets unify Chat Memory, Skills, Wiki pages, and CodeGraph data under a single registration model in TencentCloud/TencentDB-Agent-Memory.
• Fixed Binding provides the first security layer, filtering assets by Team, User, Agent, and Visibility scope before retrieval.
• ACL enables fine-grained access control for restricted visibility assets, supporting user, role, and agent-level permissions.
• The Memory Hub implements this two-stage filter as documented in README.md (line 59) and visualized in MemoryCore/openclaw-plugin/docs/architecture.md.
• The TypeScript SDK exposes AssetBinding and AssetACL types to enforce these constraints at the point of asset creation and query.

Frequently Asked Questions

What happens if an asset has visibility set to "team" but no ACL entries?

When visibility is team, the asset is accessible to all members of the specified team that pass the Fixed Binding filter. The ACL is only evaluated when visibility is explicitly set to restricted. Therefore, an empty ACL with team visibility means any team member matching the binding criteria can access the asset.

Can an agent automatically load assets bound to a different team?

No. The Fixed Binding mechanism in MemoryCore requires the requester's team identifier to match the asset's teamId field (or for the field to be empty indicating global scope). The Memory Hub applies this filter first, preventing cross-team asset leakage regardless of ACL permissions.

What permission levels are supported in the AssetACL structure?

The Permission enum supports three levels: READ for read-only access, READ_WRITE for modification rights, and FULL for complete control including sharing capabilities. These are defined in the SDK types and enforced by the Gateway when visibility is restricted.

How does the OpenClaw plugin interact with the Memory Hub's security layers?

The OpenClaw plugin (MemoryCore/openclaw-plugin/index.ts) registers client-side tools that invoke the Memory SDK. When an agent requests memory, the plugin sends the current execution context (Team, User, Agent IDs) to the Gateway. The Gateway then applies the Fixed Binding and ACL filters server-side before returning results, ensuring the security model is enforced regardless of client behavior.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}