Visibility Levels for Skills in TencentDB Agent Memory: Complete Developer Guide

The TencentDB Agent Memory platform implements five distinct visibility levels—private, task, agent, team, and restricted—that govern skill access from owner-only scopes to organization-wide sharing, enforced through both TypeScript SDK client-side validation and server-side ACL checks in the meta service.

Managing visibility levels for skills in TencentDB Agent Memory requires precise access control configurations to secure AI capabilities across organizational boundaries. In the TencentDB-Agent-Memory repository, these settings determine which users, agents, and tasks can discover and invoke specific skills. This guide examines the five visibility levels defined in the frontend API types and SDK contracts, explaining how they are enforced in the backend meta client to secure skill assets.

The Five Visibility Levels Defined

Each skill asset in the system carries a visibility attribute that controls discovery and usage permissions. The TypeScript definitions in [src/lib/api/types.ts](https://github.com/TencentCloud/TencentDB-Agent-Memory/blob/feat/server_team/MemoryPanel/web/src/lib/api/types.ts#L74-L84) establish a closed-set union type with five possible string values.

Private (Owner-Only Access)

The private visibility restricts access exclusively to the user who created the skill. No other agents, tasks, or team members can view or invoke the asset. This level is appropriate for personal development, experimental drafts, or sensitive automations that should remain isolated to the owner account.

Task (Task-Scoped Sharing)

When set to task, the skill becomes visible to any agent bound to the same task identifier. This enables workflow-specific sharing where multiple agents collaborating on a single business process need access to common tools, without exposing those capabilities to the broader user account or team.

Agent (User-Wide Sharing)

The agent level extends visibility to all agents belonging to the same user account. Unlike task-scoped sharing, this applies across different tasks and sessions, allowing skill reuse across the entire personal agent fleet while remaining invisible to other team members.

Team (Organization-Wide Access)

Setting visibility to team shares the skill across the entire organization. Every member of the team can see, reference, and execute the skill regardless of their specific agent or task assignments. The UI implements this through the Team tab, which filters for visibility: 'team' assets via the meta service.

Restricted (ACL-Controlled Access)

The restricted level subjects the asset to additional access control list (ACL) checks. A skill with this visibility can only be bound to a team if the owner explicitly grants access through whitelist mechanisms. This provides the granularity needed for sensitive operations that require audit trails or approval workflows.

Source Code Implementation and Type Definitions

The visibility system is implemented across the frontend type definitions, SDK interfaces, and backend enforcement layers.

Frontend API Types

The canonical definition of the visibility union type resides in the web frontend source:

[src/lib/api/types.ts](https://github.com/TencentCloud/TencentDB-Agent-Memory/blob/feat/server_team/MemoryPanel/web/src/lib/api/types.ts#L74-L84)

This file establishes the allowed string literals that populate dropdown menus and form validations in the Memory Panel interface.

SDK Request Payloads

The TypeScript SDK propagates visibility settings through request payloads defined in:

[sdk/memory-core/typescript/src/v3/skill-types.ts](https://github.com/TencentCloud/TencentDB-Agent-Memory/blob/feat/server_team/sdk/memory-core/typescript/src/v3/skill-types.ts)

When creating or updating skills, the SkillClient injects the visibility field into API requests according to these type contracts, ensuring only valid values are transmitted to the control plane.

Server-Side ACL Enforcement

Visibility filtering occurs in the meta service rather than the raw skill endpoint. The enforcement logic lives in:

[MemoryProxy/src/meta/client.ts](https://github.com/TencentCloud/TencentDB-Agent-Memory/blob/feat/server_team/MemoryProxy/src/meta/client.ts#L182-L207)

While the /v3/skill/list endpoint returns unfiltered results, the asset/list-accessible method in the meta client applies the visibility whitelist. This architecture ensures that UI panels—such as the Team tab implemented in useSkillsPanel.ts—only receive assets the authenticated user is authorized to view.

Practical Code Examples

The following TypeScript implementations demonstrate how to interact with visibility levels using the @tencentdb/memory-core SDK.

Creating a Skill with Team Visibility

To share a skill organization-wide during creation, specify the team visibility level in the client options:

import { SkillClient } from '@tencentdb/memory-core';

const client = new SkillClient({ teamId: 'team-123', agentId: 'agent-abc' });

await client.create({
  name: 'SummarizeChat',
  content: `# SummarizeChat\n...`,

  visibility: 'team',
});

Querying Skills by Visibility Scope

To populate the Team tab or filter by access level, query the meta service before fetching skill details:

import { SkillClient } from '@tencentdb/memory-core';
import { MetaClient } from '@tencentdb/memory-core/meta';

const meta = new MetaClient();
const skillClient = new SkillClient();

const accessible = await meta.listAccessible({
  asset_type: 'skill',
  visibility: 'team',
});

const skillIds = accessible.map(a => a.asset_id);
const skills = await skillClient.list({ skill_ids: skillIds });

Updating Visibility Post-Creation

Modify a skill's access scope using the update method with expected_version for optimistic concurrency control:

await client.update({
  skill_id: 'skl-789',
  expected_version: 3,
  content: existingContent,
  visibility: 'private',
});

Summary

• The TencentDB-Agent-Memory platform defines five visibility levels (private, task, agent, team, restricted) that control skill discovery and execution permissions.
• Type definitions in src/lib/api/types.ts and skill-types.ts establish the client-side contract, while meta/client.ts enforces server-side ACL validation.
• The raw /v3/skill/list endpoint does not filter by visibility; the meta service (asset/list-accessible) applies authorization checks before returning results to UI components.
• Team visibility enables organization-wide sharing, while restricted visibility requires explicit whitelist approval for enhanced security governance.
• Skills can change visibility levels after creation using the update method with optimistic concurrency control via expected_version.

Frequently Asked Questions

What are the five visibility levels for skills in TencentDB Agent Memory?

The platform supports private (owner-only), task (same-task agents), agent (same-user agents), team (organization-wide), and restricted (ACL-controlled). These levels are defined as a string union type in the frontend API types at src/lib/api/types.ts and propagated through the SDK.

How does the server enforce visibility restrictions when listing skills?

The control plane separates raw data retrieval from authorization. The /v3/skill/list endpoint returns unfiltered skill data, while the meta service's asset/list-accessible method—implemented in MemoryProxy/src/meta/client.ts—applies the visibility whitelist based on the caller's team membership, task bindings, and ownership status.

Can I change a skill's visibility level after it has been created?

Yes. Use the SkillClient.update() method with the expected_version parameter for concurrency control. Pass the new visibility value in the update payload to transition between levels, such as changing from team to private to restrict access.

What is the difference between task and agent visibility levels?

Task visibility (task) limits skill access to agents specifically bound to the same task identifier, enabling temporary collaboration on specific workflows. Agent visibility (agent) grants access to all agents owned by the same user account across different tasks and sessions, supporting personal tool reuse without team exposure.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}