The institutional-knowledge layer for agent fleets

Your agents forget everything. Give them memory that compounds.

ByteDesk Agent Memory is durable, permissioned, shared memory for AI agent workforces. Agents remember what they learned, departments share what they know, and the organization builds a knowledge base that compounds — with strict server-side boundaries so nothing leaks across trust lines.


The problem

Agent turns are stateless. Without a memory substrate, nothing accrues.

An agent re-learns the same facts every conversation. Departments can't share what they know. Organizational knowledge lives only in prompts. And any naive shared store leaks private context across agents and teams. A flat vector database is not a memory model — it's a leak waiting to happen.

Ownership tiers

Three tiers. Enforced server-side. Every call.

The access decision is made in the service on the verified caller identity — never by the model, never by the client. An agent can never address another agent's private memory, and a model can never talk its way across a boundary.

Organization

org:<key>

The shared brain. Every agent in the deployment can read and write it — charters, runbooks, org-wide facts that every conversation should know.

Department

dept:<slug>:<key>

Team knowledge, members only. Playbooks, tactics, and lessons that belong to one department stay inside it — gated on the caller's verified membership.

Agent

agent:<key>

Private to each individual agent. Personal lessons, working notes, and preferences no other agent can address — by construction, not by convention.

Customer segments

customer:<id>:<key>

A per-client shared brain that cross-cuts ownership: what support learned this morning, sales can use this afternoon — readable across departments.

Initiative segments

initiative:<id>:<key>

Working memory for a goal that persists across turns and contributors — many agents, one initiative, one accumulating context.

The trust model

The key is the boundary. The resolver is the law.

"An agent can never address another agent's private memory, and the model can never talk its way across a boundary."

API keys with configured principalsEach key carries its caller identity and department. Caller-declared identity is honored only for keys you mark trusted.
Server-side tier enforcement, every transportREST and MCP resolve callers through the same scope resolver — authorization is identical however a caller arrives.
Fail-closed by designAn unresolved caller collapses to org-tier access only. Denial paths are tested before boundary code ever changes.
One deployment per trust boundaryIsolation is the deployment itself — no intra-deployment multi-tenancy, no shared blast radius.
The well-known index

Canonical addresses, resolved by cascade.

Org chart, charter, runbooks — stable names every agent can rely on. Resolution walks agent → department → org, most-specific wins: one mechanism for both personal overrides and organizational defaults.


Semantic recall

Memory that surfaces itself.

Hybrid vector + keyword search scoped to a compartment — an agent recalls by meaning, and only within memory it's allowed to see. Alongside search: keyed slots, append streams, and prefix browsing.

Hybrid search, compartment-scoped

Vector similarity plus keyword match inside a single compartment. Recall never widens the caller's authority — the scope resolver bounds every query before the engine sees it.

Slots, streams, and browsing

Keyed slots for facts with one true value. Append streams for logs and running context. Prefix listing to walk a compartment like a directory.

Best-effort capture

SDK helpers write a completed agent turn into memory after the fact — never throwing, never blocking the hot path. A failed capture costs a memory, not a conversation.

Recall into the next prompt

Context providers prepend relevant memory to the next turn automatically — the agent starts every conversation already knowing what the organization knows.

Consumption surfaces

One memory. Three ways in.

Every surface resolves through the same core, so tier authorization is identical however a caller arrives.

Drop nine tools straight into your agent.

An embedded MCP server at /mcp. Any MCP-capable agent or runtime connects and immediately holds the full memory surface — reads, writes, semantic recall, and the well-known index — with its authority decided server-side.

memory_searchread
memory_getread
memory_putwrite
memory_listread
memory_unsetwrite
memory_get_well_knownread
memory_list_well_knownread
get_org_chartread
get_charterread
Deployment

Stateless service. Pinned engine. Your boundary.

The service scales horizontally; all state lives in the bundled memory engine — a vector + page store shipped as a pinned, product-owned image. Embedded store for development, PostgreSQL + pgvector for production.

Read the quickstart
  • Docker Compose for evaluation — one command, then a smoke script proves put → get → search → well-known end to end.
  • Helm chart for Kubernetes — values-driven storage selection, secrets, and probes.
  • One deployment per trust boundary — an organization, an environment. Isolation you can point at.
  • Ten minutes to first memory — including connecting an MCP agent.
Get started

Stop re-teaching your agents. Start compounding.

Deploy inside your own boundary, hand your agents the MCP tools, and watch organizational knowledge accrue from the first conversation.