Enterprise configuration

This page lists what you can configure on an Agent Memory Enterprise deployment, and what stays the same on every deployment. Use it to plan a single-tenant or self-hosted deployment, or to check whether a behaviour you want to change is a setting at all.

Where each setting lives

Per-Context settings

Each Context stores its own configuration. These settings are the same on every plan, and the Configuration reference lists each field with its default.

Not every stored model setting is applied yet. Which settings are applied shows the stages that use their per-Context model.

Deployment settings

Deployment settings apply to every Context on a deployment. On a single-tenant deployment, SurrealDB applies the values agreed with you. On a self-hosted deployment, you set them as environment variables on the Agent Memory processes, and the tables below give each variable's name.

Processes on a self-hosted deployment

A self-hosted deployment runs four kinds of process from one service image:

• •

  API: serves the REST API and the MCP server. Run as many as you need.

• •

  Worker: runs document ingest and the background passes. Run as many as you need.

• •

  Scheduler: queues the background passes. Run exactly one. It holds a lease in the database, so a second instance waits.

• •

  Management API: creates and manages Contexts, principals and keys.

The API and the management API both answer GET /api/v1/health for health checks.

Give every process the same model and provider settings. The API calls a model for /chat, /reflect and extraction on POST /facts, and the worker calls one for document ingest and the background passes.

Language models

The API uses one model for /chat, /reflect, extraction on POST /facts, and on-demand POST /elaborate and POST /consolidate calls. The worker chooses a model for each stage. The built-in models are:

A Context can choose its own model for the two worker stages. The deployment default applies to every stage that a Context leaves unset. See Which settings are applied.

Your own model

The openai_compatible provider sends language-model calls to an endpoint that speaks the OpenAI chat API, such as a model gateway or a model server you run. It replaces the language-model stages only. The embedding model stays fixed, as Fixed behaviour shows.

To use your own model as the default, set SPECTRON_LLM_PROVIDER to openai_compatible and SPECTRON_LLM_MODEL to the model ID your endpoint expects.

Agent Memory checks every connection to this endpoint:

• •

  A public address is allowed.

• •

  A private address is allowed only inside a range listed in SPECTRON_PROVIDER_OPENAI_COMPATIBLE_ALLOWED_NETWORKS.

• •

  Loopback and link-local addresses are always refused, whatever the list says. So is any host name that resolves to a refused address.

• •

  Redirects are not followed, and no proxy is used.

A model server on the same machine, or one that serves plain HTTP, therefore needs an HTTPS address on your network in front of it.

A Context cannot store its own key for openai_compatible. The key is set for the deployment only.

Document and media providers

Document ingest can read text in images, transcribe audio and video, embed images, parse whole documents and rerank passages. Each capability is off until you configure it. The ingestion_profile of each Context then decides which of the configured steps run for that Context.

A Google key alone does not turn on any of these capabilities. Set the _PROVIDER variable for each one you want. gemini (or google) is the only value these variables accept, apart from openrouter for the reranker, and any other value is an error at startup. gemini also needs SPECTRON_PROVIDER_GOOGLE_API_KEY. To use your own service instead, leave _PROVIDER unset and set _URL.

Without a document parser, Agent Memory reads hard-to-parse PDFs by rasterising each page and running OCR on it.

Your own service can use HTTP or HTTPS. _MODEL is required with _URL, and _API_KEY is optional: when it is set, Agent Memory sends it as Authorization: Bearer <key>. Each service answers a POST with JSON in these shapes:

Each segment in a speech-to-text response has text, start_seconds, end_seconds and an optional confidence.

Storage

The object storage URL takes one of these forms. The path after the bucket or container becomes a key prefix.

Credentials for S3, Google Cloud Storage and Azure come from the standard environment variables of each cloud provider.

Capacity and limits

Agent Memory has no per-key request rate limit. The concurrency limit above and the token budget below are the controls on load.

Token budget

These settings decide how a Context's token_limit is enforced on a deployment.

Network and security

Every listener serves plain HTTP or gRPC. Terminate TLS in a load balancer, ingress or gateway in front of the API and the management API.

Observability

Fixed behaviour

This behaviour is the same on every deployment, and no setting changes it:

To keep a fact past the 7-day expiry, write it with the knowledge or identity category when your application learns it. Setting the category shows how.

Related reading

• •

  Agent Memory Enterprise - what the plan adds and how it is deployed

• •

  Configuration reference - every per-Context field and its default

• •

  Models per stage - stages, providers and per-Context model choice

• •

  Multimodal content - ingestion profiles and media types