Check who can read the actual page.

An access label is useful only when it matches the content people can retrieve. Memrain provides checks for both sides: what a client's credential carries and which current credentials can read a particular page.

Explore features Read the docs

Illustrative example

Can everyone on this project read the runbook while my private notes stay outside their access?

Inspect each client's write source and read set with whoami, then have the operator check representative shared and private pages with who-can-read.

Illustrative scenario, not a live product result.

Separate actions from readable content.

Scopes determine which operations a credential can perform. Its write source determines where its changes belong, and its read set determines which sources retrieval may use. A client that can read shared knowledge does not automatically become its editor. Tool discovery reflects permission checks, while whoami shows the effective grant carried by the connection being tested.

Understand access and scopes

Test the page-read path.

The operator's who-can-read command evaluates current personal tokens and issued OAuth access tokens through the page-read rules. Source access, scope, diary restrictions and quarantine are considered together. The report groups tokens by client or enrollment and returns access verdicts without displaying page bodies or credentials. Use a few representative pages to check a new rollout or a changed sharing arrangement.

Plan memory sharing

Understand what the inventory covers.

Unused invitations and clients without access tokens appear separately. Refresh tokens, future grants and static public or internal bearers are outside this current-token inventory; large results report truncation. Team separation also depends on the documented fail-closed deployment configuration. Repeat the checks after important grant changes and verify the connected client's behavior before relying on a sharing decision.

Read team setup

Read the team access-review guide