Team Memory Has a Permission Problem, Not a Storage Problem
Put five people on one shared memory vault and it works for about a week. Then a salesperson asks their assistant what an engineer's new base salary is, and the assistant answers, because everyone writes to the same store and nothing in that store distinguishes a deal size from a salary.
Shared memory is two problems wearing one name. The first is propagation: Cindy learns something about a client and Dave's assistant should know it without Cindy retyping it on Monday. One shared vault solves that completely.
The second is authority: which facts may reach which person. Adding people to a vault does not solve that. It creates it.
Prompt rules are not access control
If the restriction lives in a system prompt, it is a request. Anyone who has shipped an LLM feature has watched a user talk a model out of an instruction, and the more sensitive the fact, the harder the attempt. A boundary a sentence can revoke is not a boundary.
The alternative is unglamorous and it holds. Decide before the prompt is built. The member's key resolves to an identity, the identity resolves to roles, the roles resolve to a union of allowed tags, and a shared memory carrying a tag outside that union gets dropped at the merge point. It never reaches the context window, so the prompt never contains the thing a clever user would try to extract.
Unrecognized identities fail closed, which in this design means untagged memory only. A misconfigured key cannot see tagged data by accident.
The tag is the unit of permission
A tag is a classification rule: a label, the question the classifier asks about each candidate memory, positive examples, and counter-examples. Is this about deal pricing, discounts, or contract value? On one side "we offered Acme 20% off the annual plan," on the other "the Q3 product roadmap."
A role is a set of allowed tags. * means every tag, including ones created after the role. People hold several roles and their effective scope is the union.
Tags beat folders for one reason. Real facts belong to more than one bucket. A renewal note is pricing, client status, and account health at the same time. A folder forces you to pick one and the other two become invisible to the person who needed them. A tag set does not force the choice, and permission checks read the tags a memory carries against the tags a role allows.
Private memory keeps auto-injecting
Organization memory is not one giant bucket. Each member keeps a private vault that auto-injects for them, and the shared org vault merges in behind it, filtered. Half-formed notes from someone's own session stay with that session. The facts the team needs cross over in real time.
That split is what makes the shared side usable. A vault where everything you type is team-visible gets treated like a public channel, and people stop writing the useful parts.
The classifier is where it breaks
Tagging runs on a small, fast model. It will be wrong sometimes, and the wrongness has an audience now. In a personal vault a bad tag produces a bad search result. In an org it can file a compensation number under a tag the sales team can read.
So the write path has a stop in it. Anything whose tagging confidence lands below a threshold, 0.6 by default, does not get trusted. It queues. A reviewer opens it, sees the three-pass trail behind the decision (extract, tag, reconcile), and approves as-is, approves with corrected tags, or dismisses it. Memories an admin seeds directly skip the queue, because a human already asserted them at full confidence.
The retention policy sits in the same place: a base default you can extend, org-specific guidance, anti_rules for things that must never be stored, and exec_rules for things that should exist only as a short high-level note.
Month two is when someone asks who saw it
Every create, update, delete, and retag of a shared memory records the actor and a timestamp. One call returns the full history of a single memory. Another returns the org-wide feed, filterable by actor, action, and start time.
That answers the two questions a manager eventually asks out loud: who changed this, and who could have read it.
Two credentials, and the split is the point
Admin work goes through your top-level credential. Inference goes through per-member keys, one per person, stamped with the org and that person's team_member_id. Identity resolves from the key itself, so there is no header to spoof and no shared login to hand around.
A member key cannot mint, list, reveal, or revoke keys, and cannot touch any org-admin route at all. It gets a 401 rather than a partial answer, because the admin router is mounted ahead of member-key auth and the key is never evaluated for those paths. What that buys you is a clean failure mode: a leaked employee key can read and write inside the policy and cannot rewrite the policy.
Raw keys come back once, at creation. Listings are masked down to a prefix and the last four characters. Removing a person removes the membership, their keys, and the auth records behind them.
Standing it up
Eight calls, all with the admin credential: create the org, create a tag, create a role that holds it, add a user, mint that user's key, seed one shared memory, make one inference call with the member key, then read the review queue. The org key appears once on creation and is never displayed again, so put it somewhere real.
The full sequence with request and response bodies, including the role-assignment and audit endpoints, is in the organizations documentation. If you want the commercial shape first, the team page lists what is included.
The order most rollouts get wrong
Start with the tags, not the people. Most teams do it backwards: they invite everyone first, discover in week two that the vault has no classification, and every memory is effectively public. Retro-fitting tags onto a live vault means re-tagging what is already in it and second-guessing each one.
Three tags carry a pilot most of the way. Pricing, client status, compensation. Then a role for each audience that should read them, and a super-role with * for whoever genuinely needs everything. The salary example in the docs runs that configuration end to end.
If you are building the thing rather than buying it, the same test applies to your own design. Ask what a person with the wrong role gets back from the retrieval call. If the answer is a memory the model was politely told not to mention, you have a prompt rule, not an access rule.
Team plans run through Enterprise, starting at a $2,000 monthly commit at $0.095 per 1M tokens. A single personal vault is $20 a month after a 14 day trial with 200M memory tokens included and $0.50 per additional 1M.
Start a vault and write the first tag before you invite anyone.