How the Loadout Model Enables Secure Experience Sharing in TencentDB Agent Memory

The loadout model equips Agents with curated Memory Assets through fine-grained visibility controls and ACL-based binding, allowing teams to share skills and knowledge while keeping private data isolated by default.

The TencentDB-Agent-Memory repository implements a sophisticated memory architecture where the loadout model serves as the central mechanism for balancing collaboration with privacy. Unlike traditional approaches that grant Agents unrestricted access to entire knowledge bases, this system binds only necessary assets to each Agent based on explicit permissions and hierarchical access controls.

Asset-Centric Design with Visibility Metadata

At the foundation of the loadout model is an asset-centric architecture where all knowledge exists as discrete, self-contained units. Each Memory Asset—whether Chat Memory, Skills, Wiki pages, or CodeGraph data—carries structured metadata including owner, version, status, and visibility settings (private, team, restricted, agent).

According to the repository's README.md, these visibility levels are defined at lines 30-34, establishing the permission boundaries before any retrieval occurs. This design ensures that assets remain independent entities with their own access control lists (ACLs), rather than existing as anonymous text chunks in a global prompt.

Fixed Binding and Hierarchical ACL Enforcement

When an Agent initializes or updates its configuration, the Hub creates a fixed binding that combines the Agent's identity with the ACL of each referenced asset. As implemented in MemoryCore/src/core/tdai-core.ts, this binding process narrows permission scopes through a strict hierarchy: team → user → agent.

The retrieval logic at README.md lines 57-61 demonstrates that the system first validates the Agent's loadout membership, then performs query-based retrieval only against assets explicitly included in that binding. This mechanism prevents concentrations of privilege, ensuring that even if an Agent is compromised, it cannot access assets outside its designated loadout.

Explicit Sharing and Private-by-Default Policy

Security in the loadout model relies on a private-by-default posture. New assets created through endpoints defined in MemoryKnowledge/openapi.yaml initialize with visibility: 'private', meaning only the creator can access them unless explicitly shared.

To enable collaboration, owners or team administrators must deliberately change visibility to team (accessible to all team members) or configure restricted ACLs for specific Agent access. This explicit sharing workflow, documented in README.md lines 25-33, ensures that experience sharing is always an intentional act rather than an accidental exposure.

Loadout-Specific Context and Layered Retrieval

When processing requests, the Hub retrieves only assets belonging to the Agent's specific loadout. The implementation in MemoryKnowledge/src/routes/tools.ts handles the /v3/agents/*/tools/call endpoint, which filters results through the Agent's bound asset list before returning any context.

For complex queries, MemoryCore/src/utils/stateful-pipeline-manager.ts manages a layered retrieval system (L0 through L3) that first examines higher-level assets (L2/L3) for quick context, then falls back to lower layers (L1/L0) using BM25 and vector search. Crucially, each layer respects the ACL of individual assets, ensuring that even deep searches never surface private data from outside the loadout.

Practical Implementation: Configuring Asset Visibility

The following TypeScript examples demonstrate how the loadout model enforces privacy boundaries through API interactions:

// 1️⃣ Define a new Skill asset (private by default)
await fetch('https://your‑hub/api/v3/assets/skill', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${TOKEN}` },
  body: JSON.stringify({
    name: 'Release‑Checklist',
    version: '1.0',
    content: '... checklist steps ...',
    visibility: 'private'          // <-- only the creator can read it
  })
});

// 2️⃣ Share the Skill with the team (make it visible to all team members)
await fetch('https://your‑hub/api/v3/assets/skill/Release‑Checklist/visibility', {
  method: 'PATCH',
  headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${TOKEN}` },
  body: JSON.stringify({ visibility: 'team' })
});

// 3️⃣ Bind the shared Skill to an Agent’s loadout
await fetch('https://your‑hub/api/v3/agents/agent‑123/loadout', {
  method: 'PUT',
  headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${TOKEN}` },
  body: JSON.stringify({
    assets: [
      { type: 'skill', name: 'Release‑Checklist' },
      { type: 'wiki', name: 'Project‑Architecture' }
    ]
  })
});

// 4️⃣ Agent makes a request; Hub only returns assets from its loadout
const resp = await fetch('https://your‑hub/api/v3/agents/agent‑123/tools/call', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${TOKEN}` },
  body: JSON.stringify({ tool: 'skill', name: 'Release‑Checklist' })
});
console.log(await resp.json());   // receives only the shared skill, never private data

These endpoints—defined in MemoryKnowledge/openapi.yaml—demonstrate how the loadout model maintains strict boundaries: private assets remain inaccessible even when Agents query shared resources, while team-visible assets propagate efficiently across authorized loadouts.

Summary

• Asset-centric architecture stores knowledge as discrete units with individual visibility metadata (private, team, restricted, agent), preventing implicit data sharing.
• Fixed binding mechanism combines Agent identity with asset ACLs through a hierarchical chain (team → user → agent), restricting retrieval to explicitly authorized content.
• Private-by-default policy ensures new assets remain inaccessible until owners explicitly modify visibility settings, eliminating accidental data leakage.
• Layered retrieval (L0-L3) with BM25 and vector search respects ACLs at every level, allowing sophisticated queries without breaching privacy boundaries.
• Loadout scoping guarantees that Agents access only their bound assets, as enforced by the Hub's request handlers in MemoryKnowledge/src/routes/tools.ts.

Frequently Asked Questions

What is the loadout model in TencentDB Agent Memory?

The loadout model is an architectural pattern that equips Agents with a specific, curated set of Memory Assets rather than granting access to an entire knowledge base. It functions as a binding mechanism between Agent identities and authorized assets, enabling precise control over what information each Agent can retrieve or modify.

How does the loadout model prevent private data leakage?

The model enforces private-by-default asset creation and requires explicit visibility changes to share information. Combined with fixed binding that attaches ACLs to Agent identities, the system retrieves only assets within an Agent's specific loadout. Even during deep searches using BM25 and vector similarity, the layered retrieval pipeline filters out private assets outside the Agent's scope.

What are the four visibility levels for Memory Assets?

The system defines four visibility states in README.md lines 30-34: private (creator-only access), team (visible to all team members), restricted (access limited to specific users or Agents), and agent (tied to specific Agent instances). These levels provide granular control over how experience and knowledge propagate across an organization.

How does the layered retrieval system work with loadouts?

The layered retrieval system organizes memory into four tiers (L0-L0) managed by MemoryCore/src/utils/stateful-pipeline-manager.ts. When an Agent queries the system, it first checks high-level context layers (L2/L3) for relevant information, then falls back to granular layers (L1/L0) using BM25 and vector search if needed. At every layer, the system validates asset ACLs against the Agent's loadout binding, ensuring that retrieved content remains within authorized boundaries.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}