Anamnesis Security and IP Containment

Anamnesis is built for privacy-sensitive environments. Memory isolation and IP containment are enforced at the architectural level, not left to prompt instructions.

Read-Only Guest Access

A local memory client can be granted read-only access to an owner's shared cloud pool. The read-only guarantee is carried by a scoped service token (memory.read) and enforced at the API layer for every route, so a read-only credential cannot write, even through the REST surface.

The One-Way Mirror (IP Containment)

Context flows out of the cloud pool; unvetted content never flows back in.

• Always-on read: a local client can read the owner's pool to gain project context.
• Local-only writes: everything the local client generates stays on the local machine.

The result is a one-way mirror: a local model can draw on the collective knowledge of the team without polluting the shared pool with unvetted content or exfiltrating IP to third-party services.

Local-First Execution

Inference can be routed per session. The default is a local, quantized model, so sensitive queries can be answered without leaving the machine. Hosted models remain available when a session opts into them.

Provenance and Trust Tiers

Every memory carries a provenance-derived trust tier (never self-claimed):

1. Established: self-authored, or an import that has been corroborated or user-accepted.
2. Provisional: an import that is not yet corroborated. It is surfaced but clearly labeled.
3. Unverified: flagged content that is not injected into the normal flow.

The design principle (see ADR-069) is that a provisional memory may not override an established one and is excluded from decision-weight. Enforcing that tiering directly in retrieval ranking is a validated capability now being rolled out behind a feature flag; it is not yet enabled in production.

This page describes the security model and its outcomes. It intentionally omits implementation internals.