agent-engine-sdk-memory 0.11.8__tar.gz → 0.11.9__tar.gz

{agent_engine_sdk_memory-0.11.8 → agent_engine_sdk_memory-0.11.9}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: agent-engine-sdk-memory
-Version: 0.11.8
+Version: 0.11.9
 Summary: Slim public Memory facade and models for Atlas Agent Engine
 License: Apache-2.0
 License-File: LICENSE
@@ -318,7 +318,7 @@ Mint the token with the `agentengine` CLI. Create a service account once — the
 client secret is shown only once, so save it immediately:
 
 ```
-agentengine service-account create my-agent --project-id <your-project-id> --role AGENT_DEVELOPER
+agentengine service-account create my-agent --project-id <your-project-id> --role PROJECT_OWNER
 ```
 
 Then exchange the client ID and secret for a short-lived (1-hour) access token
@@ -349,6 +349,13 @@ and emit a `DeprecationWarning`; passing both the new and the legacy input
 raises `ValueError`. Project API keys can no longer be minted over HTTP, so new
 integrations must use a service-account token.
 
+A service account is the right credential for a **multi-user** application: it
+may name any end user as `user_id`. A human credential may only name an end user
+other than the caller when the project enables end-user delegation; otherwise a
+`user_id` naming another user is rejected with `403`, and updates or deletes of
+another user's record are refused whatever its visibility (a project owner may
+still delete it).
+
 ### Local development
 
 Point at a backend you run yourself, such as the stack `agentengine dev up` starts.

{agent_engine_sdk_memory-0.11.8 → agent_engine_sdk_memory-0.11.9}/README.md

@@ -303,7 +303,7 @@ Mint the token with the `agentengine` CLI. Create a service account once — the
 client secret is shown only once, so save it immediately:
 
 ```
-agentengine service-account create my-agent --project-id <your-project-id> --role AGENT_DEVELOPER
+agentengine service-account create my-agent --project-id <your-project-id> --role PROJECT_OWNER
 ```
 
 Then exchange the client ID and secret for a short-lived (1-hour) access token
@@ -334,6 +334,13 @@ and emit a `DeprecationWarning`; passing both the new and the legacy input
 raises `ValueError`. Project API keys can no longer be minted over HTTP, so new
 integrations must use a service-account token.
 
+A service account is the right credential for a **multi-user** application: it
+may name any end user as `user_id`. A human credential may only name an end user
+other than the caller when the project enables end-user delegation; otherwise a
+`user_id` naming another user is rejected with `403`, and updates or deletes of
+another user's record are refused whatever its visibility (a project owner may
+still delete it).
+
 ### Local development
 
 Point at a backend you run yourself, such as the stack `agentengine dev up` starts.

{agent_engine_sdk_memory-0.11.8 → agent_engine_sdk_memory-0.11.9}/pyproject.toml

@@ -9,7 +9,7 @@ only-include = ["agent_engine_sdk_memory", "README.md", "LICENSE"]
 
 [project]
 name = "agent-engine-sdk-memory"
-version = "0.11.8"
+version = "0.11.9"
 description = "Slim public Memory facade and models for Atlas Agent Engine"
 readme = "README.md"
 license = {text = "Apache-2.0"}