| ▲ | souvik1997 21 hours ago | |||||||||||||||||||||||||||||||
Looks cool! One aspect of multi-user agent security, which I think is underexplored, is how context from a higher-privileged session might "leak" into a lower privileged session. Suppose the CEO of a company uses your shared openclaw agent and the agent writes sensitive data (investor emails, for example) to its memory. My understanding is this is not protected by Alter. Then a contractor uses the same agent and can read that same memory. It seems to me that a better agent harness for this kind of multi-user use case is needed; the standard ones like openclaw and claude code simply are not designed for it. Would love your thoughts! | ||||||||||||||||||||||||||||||||
| ▲ | simfinii 21 hours ago | parent | next [-] | |||||||||||||||||||||||||||||||
We actually account for this already! We allow developers to use alter to partition context memory based on end user + agent identity so the context leaks like the one you described can be fully prevented! Feel free to go through the docs here if you have more questions: https://docs.alterauth.com/guides/propagate-identity-to-memo... | ||||||||||||||||||||||||||||||||
| ||||||||||||||||||||||||||||||||
| ▲ | ptkachykby 11 hours ago | parent | prev [-] | |||||||||||||||||||||||||||||||
You can add a tag to each memory indicating who wrote it, and then at read time filter the memories instead of putting them in the prompt. I am the founder of Substrate, a project that lets you inspect what is in the memory and select what each agent sees. Do you separate memory per user with your harness? | ||||||||||||||||||||||||||||||||
| ||||||||||||||||||||||||||||||||