🔐 Identity-Aware Memory Manager

Most agent memory systems assume one user and one agent. The moment you deploy across teams, departments, or customers, memory isolation becomes a hard problem.

The Problem

Flat memory files like MEMORY.md don’t know who’s asking. If Alice and Bob share an agent, Alice’s private notes are visible to Bob. In enterprise deployments — HR, Finance, Engineering sharing one agent — this is a compliance nightmare.

The Solution

Identity-Aware Memory Manager adds an identity layer to every read and write. Every operation requires an IdentityContext (who is asking?), gets checked against RBAC policies, and gets recorded in an immutable audit log.

5 roles:

Role	Read Own	Read Shared	Write	Delete	Manage Users
admin	✅	✅	✅	✅	✅
manager	✅	✅	✅	✅	❌
user	✅	✅	✅	Own only	❌
reader	✅	✅	❌	❌	❌
none	❌	❌	❌	❌	❌

3 visibility levels:

PRIVATE — owner only (admin can override)
SHARED — entire tenant can read
PUBLIC — cross-tenant readable (for published knowledge)

Usage

from memory_manager import MemoryManager, IdentityContext, Role, MemoryVisibility

mm = MemoryManager("memories.db")
tenant = mm.create_tenant("acme-corp")
root = IdentityContext.admin("root", tenant.tenant_id)
mm.add_user(root, "alice", role=Role.USER)

alice = IdentityContext.user("alice", tenant.tenant_id)
entry = mm.store(alice, "API key: sk-abc123", key="openai-key")

# Bob can't see Alice's private memory
bob = IdentityContext.user("bob", tenant.tenant_id)
mm.get(bob, entry.memory_id)  # → AccessDeniedError ✅

# Shared memory — whole team can read
mm.store(alice, "Standup at 10 AM", visibility=MemoryVisibility.SHARED)

memory-manager tenant create acme-corp
memory-manager user add alice --tenant <tid> --role user
memory-manager store "Secret" --tenant <tid> --user alice
memory-manager audit --tenant <tid>

Status

✅ Complete — 74/74 tests passing

Feature	Status
Multi-tenant isolation	✅
RBAC (5 roles)	✅
Audit log (success + failure)	✅
TTL / auto-expiry	✅
Named keys + namespaces	✅
CLI (tenant/user/store/get/list/search/audit)	✅

No external dependencies. Python 3.9+. MIT License.