Privacy and permissions
Who can see which memory, what a key or token can do, and how access changes take effect — the same rules in the app, the API and MCP.
Era Brain has one rule for who sees what, and every path uses it: Era's own chat, the Brain screen, the REST API, the SDKs, the CLI and the MCP server.
A credential is never more than its person
An API key or an OAuth token works as the person who made or approved it, in one workspace, and its reach is the intersection of two things:
- what that person can do right now — re-read on every request. If their role changes, the key changes with it on the next call; if they leave the workspace, it stops working;
- the scopes it was given —
brain,brain:readorbrain:write(or wider:*,ai).
| Needs | |
|---|---|
| Search, list, get, graph, paths, explain, sources | brain:read, and the person can read Brain |
| Add, correct, forget | brain:write, and the person can change Brain |
A read-only credential that tries to write gets 403. A credential without Brain gets 404 on every Brain address — the same answer as a module that does not exist.
Who sees a memory
| The memory is | It is recalled for |
|---|---|
| shared with the workspace | everyone in that workspace who can read Brain |
| private | only the person who saved it, or whose own source it came from |
| from a module (CRM, finance …) | only people who can read that module and whose credential reaches it |
| in another workspace | nobody here — ever |
| replaced or forgotten | nobody — it is history |
A memory-only key (brain) therefore sees memories that belong to no module. Give it crm:read too and it also recalls facts that came from CRM — if its person can read CRM.
The rule covers the graph as well: an edge is shown only when its source and both ends are visible, and an entity named only by memories you cannot see is not shown at all.
Asking for a memory you may not see answers 404, exactly like one that does not exist, so ids cannot be probed. explain refuses the same way.
Where it is enforced
Row-level security in PostgreSQL keeps every query inside its organization and workspace. On top of it, one shared visibility rule — the same code for every read path — adds the module and person checks to every statement that reads memories, entities and relations.
Your controls
- Settings → API keys — create keys that reach Era Brain only, see when each was last used, revoke them.
- Settings → API keys → Connected apps — every agent you approved (Claude Code, Codex, Cursor …), with Disconnect: its tokens stop at once.
- The consent card — choose the workspace, tick only Era Brain, make it read-only.
- Brain screen — correct, keep private, forget; managers can permanently erase what Brain learned about a person for a data-subject request.
Secrets
The MCP server's instructions and the plugin's memory skill tell agents not to save secrets, passwords, keys, tokens or card numbers. If something like that was saved anyway, forget it — or, for a data-subject request, ask a manager to erase it permanently from the Brain screen.
Rate limits
Every credential has per-minute limits on the API and the MCP server, and adding memories has its own: 60 adds a minute per credential. Past a limit you get 429 with Retry-After.