Read the Source, Not the README

A 22,000-star agent memory platform ships a textbook permission system. We tested it with two tenants. Eight of nine read routes leaked.

Tencent Cloud open-sourced an agent memory layer this year, TencentDB Agent Memory: a proxy that sits between your AI agent and its model, watches the conversation, and distils what happens into durable memory other agents can be granted later. Four months after release it carries 22,800 stars, and on paper its governance is the best in the field. Every memory asset has a visibility field and a lifecycle status. A proper ACL table names one asset, one subject, one permission per row, and records who granted it. All decisions flow through a single pure permission function. One code comment even records a deliberate July decision that private means private from team administrators too, and explains the blast radius of that choice.

Reading the source, I rated this the most disciplined permission layer I had seen in the category. Then we ran the test that settles it: install the platform, create two teams, put different data in each, and hammer every read route as a member of the wrong team.

Eight of nine read routes served the other team's data to a non-member.

The permission layer is sound. The HTTP layer bypasses it. The routes that serve memory to callers simply never invoke the beautiful function that would have said no. Both facts are true at once: the platform contains an exemplary access control system, and the platform does not control access.

Why This Pattern Recurs

A governance schema is cheap to write and impressive to read, and it gets evaluated by people reading documentation. Enforcement is a wiring property, invisible in any single file, and it only gets evaluated by people running attacks. The market rewards the first activity and almost nobody performs the second, so the gap between claimed and actual isolation can persist through tens of thousands of stars and four months of production adoption.

This is not an accusation of bad faith. The comment quality in that codebase says the authors care. The version tested was v2.0.1-beta.1, a beta by its own label; the wiring will likely be fixed, and the finding was reported. The lesson is about evaluation method, not about one vendor.

An access control system you have not watched refuse a request is a diagram, not a control.

The Test Costs an Afternoon

If you are putting more than one client, team or tenant into any AI platform, run the proof before you load the second tenant's data. Create two tenants. Put a distinctive string in each. Authenticate as tenant one and call every read endpoint asking for tenant two's material: by ID, by search, by list, by export. Every route that answers is a finding. The whole exercise takes an afternoon and a test script, and it converts the vendor's claim into your own evidence.

The alternative is the industry default: trusting the README, loading client data, and discovering the wiring gap in an incident report. For anyone under PDPA or handling client-confidential material, that discovery is a notification event. An afternoon is cheaper.

Part of the Operating Principles series from KG Consultancy.