slm-governance

# slm-governance — Enterprise Compliance and Governed Workspace Behavior SuperLocalMemory supports enterprise deployments with role-based access control, retention policies, audit logging, and GDPR compliance tooling. This skill documents how agents must behave when operating in a governed workspace and how to use the governance MCP tools (available in the `power` profile). --- ## Role model Governed workspaces have three roles: | Role | Read | Write personal | Write shared/global | Admin operations | |------|------|---------------|---------------------|-----------------| | `viewer` | Yes | No | No | No | | `member` | Yes | Yes | Yes (within access list) | No | | `admin` | Yes | Yes | Yes (unrestricted) | Yes | **Agent behavior by role:** - **Viewer**: Only call `recall`, `search`, `fetch`, `list_recent`. Never call `remember`, `update_memory`, `forget`, or any write tool. If a write is attempted, fail gracefully: "This workspace is read-only in viewer mode." - **Member**: May write personal facts and shared facts with permitted profiles. May NOT write `scope="global"` facts without explicit admin authorization. May NOT call `set_retention_policy`, `audit_trail`, or `compact_memories`. - **Admin**: Full access including governance tools in the `power` profile. An agent operating in a governed workspace must check its role before any write operation. Role information is visible in workspace configuration or via `slm status --json` (the `role` field, if present)...