Agent Memory Write Guard

agent.memory_write_guard

ProductionBounded custom (Class B)Deterministicstrictinstantv1.0.0

No network

Overview

This advises and does not act: it answers whether a proposed memory write passes the policy you set, and it stores nothing itself. It is a decision point, the last gate before an agent's own store. It denies by default, and the place that bites hardest is the scan: with requireCleanScan left at its default of true and no findings field supplied at all, the answer is a denial under SCAN_MISSING, because absent evidence is not evidence of cleanliness. The same rule runs throughout — a candidate that does not say what kind it is, where it came from or how long it should live cannot satisfy a policy that asks. It neither detects nor redacts: run text.assert_pii_free or security.detect_secrets first, pass their findings here, then redact with text.mask_pii or security.redact_secrets if the write is permitted. The candidate's own content is never repeated back in the verdict, in a violation or in a failure; only its length, spans you supplied, and the labels you sent.

Agent memory is written once and read for months, so a credential or a session-only detail that slips into it keeps leaking long after the turn that produced it. Putting the decision in one skill makes the rule explicit and the verdict auditable, and keeping detection out of it means the platform has one detector rather than a weaker second one embedded in a gate.

Reliability

Fully deterministic: the same candidate, findings and policy always produce the same verdict, and violations come back in a fixed evaluation order so reason is stable, in the published order listed under reason. Every rule denies on omission rather than passing: a missing scan, a missing kind under an allowlist, a missing classification under requireClassification. It denies on an unreadable answer too — a scope or source label the escalation rule cannot place is a denial under SCOPE_UNCOMPARABLE, not a comparison skipped. Failures: MEMORY_CANDIDATE_INVALID means the candidate carried a property outside the accepted set, an empty content string, a label that is not a string of 1 to 256 characters, or a label carrying a character a reader cannot see — fix the field named in the error and retry; MEMORY_CONTENT_TOO_LARGE means content passed 65536 characters, which is a candidate too large to be one memory — split it and judge each part; MEMORY_POLICY_INVALID means a policy value fell outside its range or a minimum sat above its maximum, so no candidate could ever satisfy it — correct the bound and retry; MEMORY_POLICY_RULE_UNSUPPORTED means the policy named a rule this version does not implement, and a rule is never silently ignored — remove it or use a supported one; MEMORY_FINDINGS_INVALID means a finding was not an object, lacked its category, carried a category, severity or detector with an invisible character in it, or carried an offset outside 0 to 65536 — fix the entry and retry; MEMORY_FINDING_LIMIT_EXCEEDED means more than 1000 findings were sent, which is a candidate that should be refused at the source — deny the write rather than enumerating further.

Context footprint

The answer holds counts, labels, rule ids and offsets, never the candidate's content. Even with 1000 findings and a full policy it stays in single-digit kilobytes. A successful call costs 1 execution credit.

When to use it

Immediately before an agent writes to its own memory store, with the findings of a detection step already in hand.

When you still need to find out what is in the content, when you want it cleaned rather than judged, or when nothing is being persisted.

Scope

Note

Answer whether one proposed memory write satisfies a supplied policy, returning the verdict, the rules it broke and the policy it was judged under.

Non-goals

Does not store, cache or forward the candidate
Does not detect personal data or credentials — pass in a prior scan's findings
Does not redact anything, and never returns sanitised content
Does not repeat the candidate's content in any field, detail or failure
Does not invent a policy: with no policy supplied, the defaults still deny an unscanned candidate

Properties

IdempotentRetry safeStreaming supportedFile input supportedRequires external service

Capabilities

validation

Cost & billing

Flat rate per invocation

MetercallsBillable onsuccessCost per call1 credit

File handling

Accepts file_refProduces file_refMax input1 MB

How we handle your data

Sensitive input, safe output

What this means

This skill may receive sensitive content, but it does not target sensitive data and returns only a structured non-sensitive result.

Squillify guarantees

Runs inside Squillify
This skill runs inside Squillify.
Payloads are not sent to an external service by this skill.
Squillify does not permanently store submitted payloads.
Telemetry records metadata only, not submitted content.
Submitted payloads are not used for training.
Submitted payloads are not reviewed by humans.
This skill does not target sensitive data.
The response does not contain submitted content.

Your responsibility

Squillify does not determine whether submitted content is sensitive. Your application is responsible for deciding what data it is allowed to submit. Your application is responsible for securing the response.

Read the Microskill Data Handling Policy

Input schema

Field	Type	Required	Description
memoryCandidate	object	Yes	Closed memory candidate with required content and optional kind, scope, source, classification, ttlSeconds, and tags properties.
findings	array	No	Bounded prior-scan finding array; an empty array means a clean scan, while omission denies under the default policy. The skill refuses more than 1,000 findings with MEMORY_FINDING_LIMIT_EXCEEDED.
policy	object	No	Closed memory policy with allowlist, content-limit, TTL-limit, and fail-closed flag properties; omit it to use the documented fail-closed defaults.

Output schema

Field	Type	Required	Description
allowed	boolean	Yes	Whether every applied policy rule passed.
reason	string	Yes	Primary stable reason code in published evaluation order.
violations	array	Yes	Bounded violation array in fixed policy evaluation order; it contains from 0 through 1,000 items, each with code, severity, detail, ruleId, and optional category, span, and field properties.
resolvedPolicy	object	Yes	Closed resolved-policy audit receipt containing all applied allowlists, bounds, flags, and scanSupplied — unconstrained RFC 8259 JSON items.
candidateSummary	object	Yes	Closed candidate summary with contentChars, findingCount, tagCount, and optional labels and TTL.

API contract

POST /v1/execute

curl

curl -sS -X POST "$BASE/v1/execute" -H "Authorization: Bearer $KEY" -H 'Content-Type: application/json' -d '{"skillKey":"agent.memory_write_guard","input":{"memoryCandidate":{"content":"Prefers metric units.","kind":"preference","scope":"user"},"findings":[]}}'

Integrations

TypeScript SDK

import { Squillify } from "@squillify/sdk";

const sq = new Squillify({ apiKey: process.env.SQUILLIFY_API_KEY });

const { output } = await sq.execute("agent.memory_write_guard", {"memoryCandidate":{"kind":"preference","classification":"internal","source":"user","ttlSeconds":2592000,"content":"Prefers metric units in every report.","scope":"user"},"policy":{"requireClassification":true,"allowedKinds":["fact","preference","summary"],"forbiddenCategories":["CREDENTIAL","EMAIL"],"allowedScopes":["session","user"],"allowedClassifications":["public","internal"],"maxTtlSeconds":7776000,"requireTtl":true},"findings":[]});

Errors

Code	HTTP	Retryable	Description
VALIDATION_ERROR	400	No	The request payload failed schema validation.
UNAUTHORIZED	401	No	Missing or invalid API key.
SKILL_NOT_ACCESSIBLE	403	No	The API key is not granted access to this skill.
SKILL_NOT_AVAILABLE_FOR_PLAN	403	No	This skill is not included in your current plan.
PLAN_ELIGIBILITY_UNAVAILABLE	503	Yes	Plan eligibility could not be decided. Retry after backoff.
SKILL_NOT_FOUND	404	No	The requested skill or version does not exist.
TENANT_RATE_LIMITED	429	Yes	Request rate limit exceeded. Retry after backoff.
QUOTA_EXCEEDED	429	Yes	Plan quota exhausted. Retryable once the quota period resets.
EXECUTION_TIMEOUT	504	Yes	Execution exceeded the allowed time budget.
MEMORY_CANDIDATE_INVALID	400	No	The request payload failed this skill's input validation.
MEMORY_CONTENT_TOO_LARGE	429	No	A size, quota, rate, or time limit was exceeded.
MEMORY_POLICY_INVALID	400	No	The request payload failed this skill's input validation.
MEMORY_POLICY_RULE_UNSUPPORTED	400	No	The skill does not support the requested variant.
MEMORY_FINDINGS_INVALID	400	No	The request payload failed this skill's input validation.
MEMORY_FINDING_LIMIT_EXCEEDED	429	No	A size, quota, rate, or time limit was exceeded.

Other limits

Limit	Value
Recommended inline bytes	32 KiB

Limitations

Does not store, cache or forward the candidate
Does not detect personal data or credentials — pass in a prior scan's findings
Does not redact anything, and never returns sanitised content
Does not repeat the candidate's content in any field, detail or failure
Does not invent a policy: with no policy supplied, the defaults still deny an unscanned candidate
Finding secrets or personal data in the content itself
Producing a cleaned version of the content for storage
Storing the memory, which stays entirely with your own store

How to call

POST /v1/execute (requires authentication)

Request bodyjson

{
  "skillKey": "agent.memory_write_guard",
  "input": {
    "memoryCandidate": {
      "kind": "preference",
      "classification": "internal",
      "source": "user",
      "ttlSeconds": 2592000,
      "content": "Prefers metric units in every report.",
      "scope": "user"
    },
    "policy": {
      "requireClassification": true,
      "allowedKinds": [
        "fact",
        "preference",
        "summary"
      ],
      "forbiddenCategories": [
        "CREDENTIAL",
        "EMAIL"
      ],
      "allowedScopes": [
        "session",
        "user"
      ],
      "allowedClassifications": [
        "public",
        "internal"
      ],
      "maxTtlSeconds": 7776000,
      "requireTtl": true
    },
    "findings": []
  }
}

Examples

A labelled candidate with a clean scan, allowed under a full policy

Inputjson

{
  "memoryCandidate": {
    "kind": "preference",
    "classification": "internal",
    "source": "user",
    "ttlSeconds": 2592000,
    "content": "Prefers metric units in every report.",
    "scope": "user"
  },
  "policy": {
    "requireClassification": true,
    "allowedKinds": [
      "fact",
      "preference",
      "summary"
    ],
    "forbiddenCategories": [
      "CREDENTIAL",
      "EMAIL"
    ],
    "allowedScopes": [
      "session",
      "user"
    ],
    "allowedClassifications": [
      "public",
      "internal"
    ],
    "maxTtlSeconds": 7776000,
    "requireTtl": true
  },
  "findings": []
}

Expected outputjson

{
  "candidateSummary": {
    "contentChars": 37,
    "kind": "preference",
    "scope": "user",
    "classification": "internal",
    "ttlSeconds": 2592000,
    "findingCount": 0,
    "tagCount": 0
  },
  "allowed": true,
  "resolvedPolicy": {
    "allowedKinds": [
      "fact",
      "preference",
      "summary"
    ],
    "allowedScopes": [
      "session",
      "user"
    ],
    "allowedClassifications": [
      "public",
      "internal"
    ],
    "forbiddenCategories": [
      "CREDENTIAL",
      "EMAIL"
    ],
    "maxContentChars": 65536,
    "minContentChars": 1,
    "maxTtlSeconds": 7776000,
    "requireSource": false,
    "requireClassification": true,
    "requireTtl": true,
    "requireCleanScan": true,
    "denyOnUnknownKind": true,
    "forbiddenScopeEscalation": true,
    "scanSupplied": true
  },
  "reason": "ALLOWED",
  "violations": []
}

Tip

The empty findings array is what makes this pass: it states that a scan ran and found nothing. Leaving the field out instead would deny under SCAN_MISSING.

A candidate denied for a forbidden finding, a widened scope and a missing retention