Keep access intentional.

Start with a project scope

Scopes organize knowledge within a workspace. Access to a parent scope can cover its descendants. A token for one project does not grant access to sibling projects or a broader parent scope.

Copy the actual scope path from Access when configuring a workflow. If you omit the scope when issuing a token, it defaults to the workspace root. Select a narrower scope deliberately.

Separate reading from changing

• Read: retrieve facts, entities, changes and briefs within the permitted scope. Contact tools require access at the workspace root.
• Write: also ingest notes, record conventions or decisions, link fact sources and create or update contacts within the required scope.
• Admin: a broader permission tier. Routine memory integrations do not need it.

The hosted endpoint derives workspace and agent identity from the bearer token. Passing a different organization in a prompt or request body does not switch workspaces.

Use short-lived tokens, and revoke them

A scope administrator issues tokens from Access → Tokens. The default lifetime is seven days; the issuance endpoint caps it at 90 days. Choose a shorter lifetime for temporary work. The raw token is returned once; Willder stores its hash.

To end access early, open Access → Tokens, choose revoke on the token and confirm. A scope administrator can revoke an active token. Subsequent hosted MCP requests with that token return HTTP 401; revocation does not remove information already returned.

Creating a replacement token does not disable the old one. Review both user grants and agent tokens when access changes; do not assume closing one access path closes every other path. If a credential is exposed, stop the affected integration and revoke that token.

Limits on agent access

• An agent token with admin permission expires within 2 hours and cannot extend itself.
• A write into a scope after reading content from outside it, such as a sibling or a parent scope, is refused unless the agent declares the share. A declared share is recorded, and readers of the scope it came from are told.
• Connecting a source that more people or agents would read than at the source needs a confirmation, and that confirmation is recorded.

Review the audit log in context

Use Audit to inspect access decisions recorded by the permission checks. Look at the actor, action, target scope and outcome when investigating a denied request or an unexpected workflow action.

A missing, expired or revoked bearer token can be rejected with HTTP 401 before a tool reaches its permission check. That response does not necessarily create a new access-audit row. An access audit does not by itself prove an answer is accurate or capture every step in an external agent’s reasoning. Keep the agent’s task and approval history alongside it.

Understand what changes memory

• Add: uploads and MCP ingestion queue processing. A queued note may not be searchable immediately.
• Correct: use the app’s fact editing controls where available. A correction removes the old fact and queues the revised text; it is not an immediate replacement in search.
• Remove: memory removal is available through authorized app operations. MCP has no delete tool; updates go through memory_ingest.
• Track sources: a provenance link records a relationship for staleness checks. It does not automatically refresh the fact when the source changes.

Disconnecting a source attempts to retire its ingested content and stop future syncs. Older content with incomplete source tracking can remain searchable. Check the disconnect result and verify removal; contact support if the source still appears in answers.

Deleting a fact is not a promise of erasure from uploaded source files, backups or external copies. For a broader data deletion request, contact Tri and review the privacy policy.

Check retrieval availability

General memory queries use graph and vector search; a workspace's account settings can limit which of the two it uses. Structured application records and original files are not general search backends yet.