Give each client the context it needs.
Shared memory does not mean every client needs every page. Memrain binds credentials to sources and scopes so an operator can define the intended access for each person or application.
Illustrative example
Can this teammate read the shared runbook without reading my private notes?
Assign the shared source to that teammate’s read grant and verify access to representative shared and private pages.
Illustrative scenario, not a live product result.Choose the credential for the client.
Personal access tokens provide a direct connection path. OAuth clients support browser connector flows, including an enrollment mode for a shared organization connector. The operator decides the allowed scopes and sources. A static public bearer exists for a limited read surface; it is not the credential to distribute to individual people when you need per-person access and revocation.
Make the permitted surface visible.
Tool discovery reflects the credential’s permission checks, so a client sees the operations it is allowed to call. Write access needs an appropriate source grant. The whoami tool helps inspect what a credential carries, and operator access-review commands check issued credentials against the actual page-read path. Review concrete pages rather than assuming a label or connector name proves separation.
Match the controls to the deployment.
Per-person separation is application-enforced and currently documented as pilot-grade. Team deployments need fail-closed configuration and Dynamic Client Registration disabled. There is no SAML, federated OpenID Connect login or SCIM synchronization. Admin access is broader than a teammate’s client access. For stronger organizational separation, evaluate independent stacks and the full requirements with the people responsible for security.
Keep the context. Move the work forward.
Connect your knowledge to the AI you already use. Find your starting point and make the next conversation count.