Asset Visibility Levels in TencentDB Agent Memory: The Complete Developer Guide

TencentDB Agent Memory implements five distinct asset visibility levels—private, team, restricted, agent, and task—that govern access control for skills, wiki pages, and code graphs across both frontend interfaces and backend services.

Every asset stored in TencentDB Agent Memory carries a visibility property that determines who can view or utilize it. The system implements granular access control through the AssetVisibility type, which is consistently enforced across the TypeScript SDK and backend metadata services. Understanding these five visibility scopes is essential for building secure multi-agent workflows and managing sensitive data within the Tencent Cloud ecosystem.

The Five Asset Visibility Levels Defined

The AssetVisibility union type defines five distinct scopes that control access to assets such as skills, wiki pages, and code graphs.

Private Visibility

private assets are owned solely by their creator and remain hidden from all other team members. This scope is ideal for personal experiments, draft configurations, or sensitive prototypes that should not be shared across the organization.

Team Visibility

team assets are public to the whole team, allowing any member to read them while owners retain the ability to grant additional rights. This visibility level supports shared knowledge bases, reusable skills, and common resources that need broad accessibility within the team boundary.

Restricted Visibility

restricted assets are visible only to specific subsets of users defined by Access Control List (ACL) rules. This scope protects sensitive data that must be limited to certain roles or departments while remaining within the team workspace.

Agent Visibility

agent assets are bound to a particular Agent and are accessible only through that Agent's context. This level isolates agent-specific prompts, tools, and configurations from other agents in the system, ensuring contextual isolation.

Task Visibility

task assets are scoped to a single task execution and automatically expire after the task completes. This transient scope manages temporary artifacts generated during workflow execution without cluttering permanent storage.

TypeScript Type Definitions in the SDK

The visibility levels are formally defined in the core TypeScript type declarations. In the SDK, the file sdk/memory-core/typescript/src/v3/metadata-types.ts defines the union type AssetVisibility at line 14:

// sdk/memory-core/typescript/src/v3/metadata-types.ts
export type AssetVisibility = 
  | 'private' 
  | 'team' 
  | 'restricted' 
  | 'agent' 
  | 'task';

The server component mirrors this definition in MemoryCore/src/metadata/types.ts at line 25 to ensure type consistency across the backend services. Both definitions utilize string literal unions rather than numeric enums, providing better type safety and autocompletion in TypeScript IDEs.

Backend Validation and ACL Enforcement

The metadata service validates visibility parameters when creating or updating assets. In MemoryCore/src/metadata/service/metadata-service.ts (lines 162-172), the service ensures that the correct visibility scope is stored and enforced:

// MemoryCore/src/metadata/service/metadata-service.ts
async updateAssetVisibility(
  assetId: string, 
  visibility: AssetVisibility,
  userContext: UserContext
) {
  // Validate that the user has permission to set this visibility level
  if (visibility === 'restricted' && !userContext.canManageACLs()) {
    throw new ForbiddenError('Insufficient permissions for restricted visibility');
  }
  // Apply visibility update with ACL validation...
}

This validation layer prevents unauthorized elevation of asset visibility and ensures that restricted assets maintain their ACL constraints throughout their lifecycle.

Frontend Implementation: Filtering by Visibility

The frontend panels rely on the same enum values to filter displayed assets. The Skills page specifically filters assets by visibility when displaying the "team" tab. In MemoryPanel/web/src/pages/SkillsPage/hooks/useSkillsPanel.ts (lines 149-159), the hook filters the asset list:

// MemoryPanel/web/src/pages/SkillsPage/hooks/useSkillsPanel.ts
const teamSkills = useMemo(() => {
  return allSkills.filter(skill => skill.visibility === 'team');
}, [allSkills]);

// When fetching from API
const { data } = useQuery(['skills', visibility], () => 
  listAccessibleAssets({ visibility: ['team'] })
);

This implementation ensures that the UI only presents assets the user is authorized to view, matching the backend's access control logic.

Practical Code Examples for Asset Creation

When creating new assets, developers must specify the appropriate visibility level to control access patterns.

Creating a Team-Visible Skill

import { createSkill } from '@/api/skill';

await createSkill({
  name: 'Summarize Document',
  description: 'Summarizes any PDF using the GPT-4 model',
  visibility: 'team',   // Shared with the entire team
  config: {
    model: 'gpt-4',
    maxTokens: 2000
  }
});

Filtering Assets by Multiple Visibility Levels

import { listAccessibleAssets } from '@/api/assets';

// Retrieve both team and agent-scoped assets
const accessibleAssets = await listAccessibleAssets({ 
  visibility: ['team', 'agent'] 
});

// Process agent-specific configurations
const agentConfigs = accessibleAssets.filter(
  asset => asset.visibility === 'agent'
);

Setting Task-Scoped Temporary Storage

// Create a temporary artifact during workflow execution
await createTemporaryArtifact({
  name: 'intermediate-analysis',
  data: analysisResults,
  visibility: 'task',  // Automatically cleaned up after task completion
  taskId: currentTaskId
});

Summary

• Five distinct scopes control asset access: private (creator-only), team (organization-wide), restricted (ACL-limited), agent (context-bound), and task (temporary).
• Type safety is enforced through the AssetVisibility union type defined in both sdk/memory-core/typescript/src/v3/metadata-types.ts and MemoryCore/src/metadata/types.ts.
• Backend validation occurs in MemoryCore/src/metadata/service/metadata-service.ts, preventing unauthorized visibility changes.
• Frontend filtering implementations in hooks like useSkillsPanel.ts ensure UI components respect visibility boundaries.
• Best practice: Use team visibility for reusable skills, agent for specialized configurations, and task for transient workflow data.

Frequently Asked Questions

How do I change the visibility of an existing asset in TencentDB Agent Memory?

Update the asset using the metadata service with the new visibility value, provided you have the appropriate permissions. The system validates ACL capabilities for restricted visibility and ownership rights for private to team transitions. Changes take effect immediately across all active sessions.

What is the default visibility level for new assets?

Assets created without explicit visibility default to private to ensure secure-by-default behavior. Developers should explicitly set visibility: 'team' when creating shared resources to avoid isolation issues.

Can an asset have multiple visibility levels simultaneously?

No, AssetVisibility is a single-value union type, not a bitmask. Each asset maintains exactly one visibility state. To simulate multiple access patterns, create separate asset instances with different visibility levels or use restricted visibility with granular ACL rules.

How does task visibility affect storage costs and cleanup?

Assets marked with task visibility are automatically garbage collected after task completion, typically within 24 hours. This transient scope prevents storage accumulation from workflow artifacts, reducing long-term storage costs compared to team or agent visibility levels which persist indefinitely until manually deleted.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}