# Visibility Levels for Skills in TencentDB Agent Memory: Complete Developer Guide

> Understand TencentDB Agent Memory visibility levels: private, task, agent, team, and restricted. Learn how TypeScript SDK and ACLs control skill access for developers.

- Repository: [Tencent Cloud/TencentDB-Agent-Memory](https://github.com/TencentCloud/TencentDB-Agent-Memory)
- Tags: deep-dive
- Published: 2026-08-30

---

**The TencentDB Agent Memory platform implements five distinct visibility levels—`private`, `task`, `agent`, `team`, and `restricted`—that govern skill access from owner-only scopes to organization-wide sharing, enforced through both TypeScript SDK client-side validation and server-side ACL checks in the meta service.**

Managing visibility levels for skills in TencentDB Agent Memory requires precise access control configurations to secure AI capabilities across organizational boundaries. In the TencentDB-Agent-Memory repository, these settings determine which users, agents, and tasks can discover and invoke specific skills. This guide examines the five visibility levels defined in the frontend API types and SDK contracts, explaining how they are enforced in the backend meta client to secure skill assets.

## The Five Visibility Levels Defined

Each skill asset in the system carries a **visibility** attribute that controls discovery and usage permissions. The TypeScript definitions in [[`src/lib/api/types.ts`](https://github.com/TencentCloud/TencentDB-Agent-Memory/blob/main/src/lib/api/types.ts)](https://github.com/TencentCloud/TencentDB-Agent-Memory/blob/feat/server_team/MemoryPanel/web/src/lib/api/types.ts#L74-L84) establish a closed-set union type with five possible string values.

### Private (Owner-Only Access)

The `private` visibility restricts access exclusively to the user who created the skill. No other agents, tasks, or team members can view or invoke the asset. This level is appropriate for personal development, experimental drafts, or sensitive automations that should remain isolated to the owner account.

### Task (Task-Scoped Sharing)

When set to `task`, the skill becomes visible to any agent bound to the same **task** identifier. This enables workflow-specific sharing where multiple agents collaborating on a single business process need access to common tools, without exposing those capabilities to the broader user account or team.

### Agent (User-Wide Sharing)

The `agent` level extends visibility to all agents belonging to the same user account. Unlike task-scoped sharing, this applies across different tasks and sessions, allowing skill reuse across the entire personal agent fleet while remaining invisible to other team members.

### Team (Organization-Wide Access)

Setting visibility to `team` shares the skill across the entire organization. Every member of the team can see, reference, and execute the skill regardless of their specific agent or task assignments. The UI implements this through the *Team* tab, which filters for `visibility: 'team'` assets via the meta service.

### Restricted (ACL-Controlled Access)

The `restricted` level subjects the asset to additional access control list (ACL) checks. A skill with this visibility can only be bound to a team if the owner explicitly grants access through whitelist mechanisms. This provides the granularity needed for sensitive operations that require audit trails or approval workflows.

## Source Code Implementation and Type Definitions

The visibility system is implemented across the frontend type definitions, SDK interfaces, and backend enforcement layers.

### Frontend API Types

The canonical definition of the visibility union type resides in the web frontend source:

[[`src/lib/api/types.ts`](https://github.com/TencentCloud/TencentDB-Agent-Memory/blob/main/src/lib/api/types.ts)](https://github.com/TencentCloud/TencentDB-Agent-Memory/blob/feat/server_team/MemoryPanel/web/src/lib/api/types.ts#L74-L84)

This file establishes the allowed string literals that populate dropdown menus and form validations in the Memory Panel interface.

### SDK Request Payloads

The TypeScript SDK propagates visibility settings through request payloads defined in:

[[`sdk/memory-core/typescript/src/v3/skill-types.ts`](https://github.com/TencentCloud/TencentDB-Agent-Memory/blob/main/sdk/memory-core/typescript/src/v3/skill-types.ts)](https://github.com/TencentCloud/TencentDB-Agent-Memory/blob/feat/server_team/sdk/memory-core/typescript/src/v3/skill-types.ts)

When creating or updating skills, the `SkillClient` injects the visibility field into API requests according to these type contracts, ensuring only valid values are transmitted to the control plane.

### Server-Side ACL Enforcement

Visibility filtering occurs in the meta service rather than the raw skill endpoint. The enforcement logic lives in:

[[`MemoryProxy/src/meta/client.ts`](https://github.com/TencentCloud/TencentDB-Agent-Memory/blob/main/MemoryProxy/src/meta/client.ts)](https://github.com/TencentCloud/TencentDB-Agent-Memory/blob/feat/server_team/MemoryProxy/src/meta/client.ts#L182-L207)

While the `/v3/skill/list` endpoint returns unfiltered results, the `asset/list-accessible` method in the meta client applies the visibility whitelist. This architecture ensures that UI panels—such as the Team tab implemented in [`useSkillsPanel.ts`](https://github.com/TencentCloud/TencentDB-Agent-Memory/blob/main/useSkillsPanel.ts)—only receive assets the authenticated user is authorized to view.

## Practical Code Examples

The following TypeScript implementations demonstrate how to interact with visibility levels using the `@tencentdb/memory-core` SDK.

### Creating a Skill with Team Visibility

To share a skill organization-wide during creation, specify the `team` visibility level in the client options:

```typescript
import { SkillClient } from '@tencentdb/memory-core';

const client = new SkillClient({ teamId: 'team-123', agentId: 'agent-abc' });

await client.create({
  name: 'SummarizeChat',
  content: `# SummarizeChat\n...`,

  visibility: 'team',
});

```

### Querying Skills by Visibility Scope

To populate the Team tab or filter by access level, query the meta service before fetching skill details:

```typescript
import { SkillClient } from '@tencentdb/memory-core';
import { MetaClient } from '@tencentdb/memory-core/meta';

const meta = new MetaClient();
const skillClient = new SkillClient();

const accessible = await meta.listAccessible({
  asset_type: 'skill',
  visibility: 'team',
});

const skillIds = accessible.map(a => a.asset_id);
const skills = await skillClient.list({ skill_ids: skillIds });

```

### Updating Visibility Post-Creation

Modify a skill's access scope using the `update` method with `expected_version` for optimistic concurrency control:

```typescript
await client.update({
  skill_id: 'skl-789',
  expected_version: 3,
  content: existingContent,
  visibility: 'private',
});

```

## Summary

- The TencentDB-Agent-Memory platform defines **five visibility levels** (`private`, `task`, `agent`, `team`, `restricted`) that control skill discovery and execution permissions.
- Type definitions in [`src/lib/api/types.ts`](https://github.com/TencentCloud/TencentDB-Agent-Memory/blob/main/src/lib/api/types.ts) and [`skill-types.ts`](https://github.com/TencentCloud/TencentDB-Agent-Memory/blob/main/skill-types.ts) establish the client-side contract, while [`meta/client.ts`](https://github.com/TencentCloud/TencentDB-Agent-Memory/blob/main/meta/client.ts) enforces server-side ACL validation.
- The raw `/v3/skill/list` endpoint does not filter by visibility; the **meta service** (`asset/list-accessible`) applies authorization checks before returning results to UI components.
- **Team visibility** enables organization-wide sharing, while **restricted** visibility requires explicit whitelist approval for enhanced security governance.
- Skills can change visibility levels after creation using the `update` method with optimistic concurrency control via `expected_version`.

## Frequently Asked Questions

### What are the five visibility levels for skills in TencentDB Agent Memory?

The platform supports `private` (owner-only), `task` (same-task agents), `agent` (same-user agents), `team` (organization-wide), and `restricted` (ACL-controlled). These levels are defined as a string union type in the frontend API types at [`src/lib/api/types.ts`](https://github.com/TencentCloud/TencentDB-Agent-Memory/blob/main/src/lib/api/types.ts) and propagated through the SDK.

### How does the server enforce visibility restrictions when listing skills?

The control plane separates raw data retrieval from authorization. The `/v3/skill/list` endpoint returns unfiltered skill data, while the meta service's `asset/list-accessible` method—implemented in [`MemoryProxy/src/meta/client.ts`](https://github.com/TencentCloud/TencentDB-Agent-Memory/blob/main/MemoryProxy/src/meta/client.ts)—applies the visibility whitelist based on the caller's team membership, task bindings, and ownership status.

### Can I change a skill's visibility level after it has been created?

Yes. Use the `SkillClient.update()` method with the `expected_version` parameter for concurrency control. Pass the new `visibility` value in the update payload to transition between levels, such as changing from `team` to `private` to restrict access.

### What is the difference between task and agent visibility levels?

Task visibility (`task`) limits skill access to agents specifically bound to the same task identifier, enabling temporary collaboration on specific workflows. Agent visibility (`agent`) grants access to all agents owned by the same user account across different tasks and sessions, supporting personal tool reuse without team exposure.