01
Default deny
An agent sees only explicitly allowed workspaces, projects, data classes and operations.
Security and ownership
Who can see what. How you take it with you.
This page separates three things that are usually blurred together: behaviour working in the current deployment, work in progress with a defined gate, and claims we deliberately do not make yet.
Invariants
Rules that do not depend on a prompt.
These hold in code and configuration, not in instructions to a model. A control counts as implemented only when it has been tested against a concrete attempt to break it.
02
The whole vault is never sent
Context is bounded. Deeper retrieval is scoped and on demand.
03
Every record is bound
Workspace, project, actor, trust zone, provenance and data class travel with every record and operation.
04
Agents read, search and propose
Only the workspace consolidator publishes canonical memory.
05
Protected targets
Goals, policies, permissions and identities cannot be changed by an agent.
06
Taint is monotonic
Untrusted content can raise scrutiny and never lower it. A tainted session cannot perform actions that need approval.
07
Secrets stay apart
Connector secrets are separated from memory and from model context.
08
Audit without leakage
Logs keep metadata, digests and results, not raw secrets or unnecessary memory content.
The technical model
Scopes, provenance and the write path.
Identity
Working now
Workspace, actor, trust zone and role come from the token
Each agent zone holds its own revocable bearer token. Projects are selected from the token's catalogue and selection cannot widen authority.
Scope
Working now
Server-enforced project and data-class scopes
A restricted fixture has been hidden from the catalogue and refused on direct retrieval, search, cursor replay and proposal target. Continuous cross-tenant coverage is an alpha gate.
Provenance
Working now
Every context response carries source and compile time
You can trace a served fact to the document, the date and the person or agent who put it there.
Write path
Working now
Append-only proposals, quarantine, single publisher
Proposals are attested, de-duplicated by request id and delivered exactly once. Tainted proposals go to a marked quarantine for stricter review.
Format
Verified
Canonical memory is versioned Markdown
It opens in any editor and needs no Unforgetter software to read.
Material scope
What belongs in the memory during the alpha.
You decide what is connected. Nothing reaches the memory unless you configure it as a source, and this is where the boundary for an early product is stated in full.
In scope
Project, product and client working material
Status, decisions and their reasons, preferences and methods, open threads and the documents they trace back to. Client material can be kept in its own scope so other scopes cannot list or retrieve it.
Not yet
Special-category personal data
Health, biometric and similar categories are outside the alpha while the DPA, the subprocessor list and an independent penetration test are still outstanding.
Never
Production credentials and secrets
Keys, tokens and passwords belong in a secret manager. Connector secrets are kept apart from memory and from model context.
If the material you need to keep sits outside this, say so in the application. The requirement is more useful now than at onboarding.
Hosting and processing
Where things run today, stated as facts.
The current service is a single-workspace deployment. Hosting changes for external alpha workspaces will be published here before they take effect.
| Component | Today | Status |
|---|---|---|
| Gateway (context, search, proposals, MCP) | Hosted on Railway in an EU West region with persistent storage | Working now |
| Canonical writer and consolidation | Runs on a controlled machine under the workspace owner; publishes to the gateway every 15 minutes and after each consolidation | Working now |
| Canonical memory format | Versioned Markdown plus an append-only proposal journal | Verified |
| This website | Static site on Vercel; no product data, no accounts, no memory | Verified |
| Model providers | Claude, ChatGPT / Codex, Cursor and Grok Bot receive scoped, bounded context through MCP. No workspace dump. Provider retention and training policies are recorded per data class | Compatible |
Ownership
Leaving must be as easy as joining.
Export, revoke and delete are product functions in the alpha foundation, each with a live smoke test as its gate.
In build
Export
A workspace export is readable Markdown plus a provenance manifest. It must open without Unforgetter.
In build
Revoke
Revoking an agent's connection stops it being served immediately. Current tokens are revocable and time-limited; the self-service flow is in build.
In build
Delete
A deleted workspace disappears from every serving path, including indexes and, after the documented retention window, backups.
Working now
Version history
Changes are versioned with actor and evidence. You can see what moved, when and why.
- workspace/
- booking-product/
- working-state.md · compiled record
- history/ · superseded and rejected entries
- methods.md · conventions for this project
- company/
- policies.md · protected
- writing.md · portable method
- journal.jsonl · append-only proposals and publishes
- manifest.json · scopes, actors, compile times
- booking-product/
# Working state · booking product
compiled: 2026-08-26T14:15+02:00
scope: booking-product
## Decisions
- [approved 2026-08-06] Fees and refunds measure against the
original booking date.
supersedes: draft 2026-07-22 · source: decision-record-14
## Open threads
- [open since 2026-08-15] Capacity split unresolved.
rule: do not implement around it
## Methods
- Money is stored in minor units, never as a float.
## Rejected
- [rejected 2026-08-06] Fee measures against the rescheduled date.Agent and model security
Models are treated as untrusted decision-makers, not as access control.
- Model output is validated against schemas and policy before anything downstream uses it.
- External content is marked untrusted at ingress; taint follows chunks, context and proposals.
- Read and act are separated in the gateway. Tainted sessions can read, analyse and propose, nothing more.
- An injection canary is planted in test task material. If it appears in a proposal or a tool action it is counted as an event, and the target is zero.
- Approval is a server-side object that is short-lived and operation-specific. A model saying the owner agreed is not an approval.
Not claimed
What you will not find on this page.
Not claimed
SOC 2, ISO 27001 or similar
No certification exists and none is implied. Change logs, access reviews and incident processes are collected from day one so an audit is possible later.
Planned
Independent penetration test
Planned before any workspace with sensitive data and before a paid public beta. Not yet performed.
In build
Multi-tenant isolation
Specified with adversarial cross-tenant tests as its gate. Not claimed until the gate passes.
In build
DPA and subprocessor list
Drafted as part of the alpha readiness review. Published before external workspaces are admitted.
If you need a specific control before you can consider the alpha, say so in your application. It is more useful to hear the requirement now than to discover it at onboarding.
Private alpha
Ask the hard question in the application.
Applications are read by the person building the system. Security requirements and blockers are welcome.