Memory, documents and web — AI Portal Docs

These tools let an agent reach what lies outside the conversation: what it remembers about you, your organisation’s documents, your budget, your past conversations and the public web. Each resolves its scope from the turn on the backend.

Key rules

Memory is called, never preloaded. The agent searches it when needed.
Statements and excerpts stay apart. A document excerpt can be cited; a remembered statement cannot borrow that authority.
Access failures look like absence. A document the turn may not read is refused as though it did not exist.
Web pages are material, not instructions. Private and loopback addresses are refused.

Memory and documents

Memory statements and document excerpts live in one store, told apart by origin. Both searches embed natural language through the model proxy, fuse keyword and meaning into one ranking, and return hits; no vector enters the model context.

They remain two tools because an excerpt can be cited, and a statement the assistant once wrote about somebody must not borrow that authority. Memory search returns fewer hits than document search.

Writing memory

A memory write outlives the conversation, so its description is conservative.

A batch stores one record per fact; nothing is deduplicated on the way in.
A replacement stores the new fact before retiring the old, so the worst case of the two separate calls is a duplicate.
Forgetting stops recall but keeps the record, which you can restore.
A write names no scope: every statement lands in the collection owned by the person having the conversation.
An optional expiresAt gives a statement a shorter life; without it, it stands until forgotten or replaced.
A refused write is one entry in the failed list with the backend’s code and message, because “not permitted” is final and “backend down” is not.

You manage your memories in Settings → Memory.

Reading documents

read_document assembles the passages not yet superseded, so the answer is the current revision.

The document must sit in a knowledge base this agent binds and be readable by the turn owner — or be a file attached anywhere in this conversation. Any failure is refused as though the document did not exist.
The read names the document’s indexing status and waits up to a minute for one still being read. A failed document returns its reason and no text.
A page range reads only passages on those pages; a document with no page numbers refuses a range.
One call returns at most 40,000 characters however many documents it names. A document the budget cuts carries the position to read on from, and the cut is declared.
It uses the same window contract as web page reading (below).

Listing sources names each knowledge base with its documents, says how many the cap left out, and names any empty knowledge base.

Attachments

read_document is offered when the agent binds knowledge or the conversation holds a document attachment.
search_attachments is offered with an attachment and reaches only documents attached in that conversation. It stays separate from knowledge search so a file you sent is not ranked against the organisation’s library. Like knowledge search, it needs the organisation’s embedding model.

How attachments are processed lives on Knowledge pipeline; ranking on Retrieval.

Budget

The budget tool checks the department half against the turn owner, not the agent; a person’s own spend is always theirs.

A refusal carries its own code rather than a zero or an outage.
The budget is the effective one, read from the most specific policy that exists — the person’s own, their department’s or the organisation’s — whether higher or lower. See Budgets and policy.
The remainder is never negative.
The period is the calendar month in UTC, with both boundaries in the answer.

Past conversations

Past-conversation search matches words, so the model sends the phrasing it expects in several spellings.

Only what people wrote matches and returns — never tool output or thinking summaries.
Whose conversations is resolved from the turn. Archived conversations stay in scope; deleted ones leave it.
No match is an empty list, not an error.
A hit is one message, so a conversation can match many times. The trace groups hits by conversation, names each once, and says how many of its messages matched.

Public web

Provider and network checks run before the tool list exists. Search goes to the organisation’s approved provider and page extraction runs in its account. A request to Google means search, never a composed results URL for the reader.

Searching: `research_web`

Searches every angle together and reads at most three pages.
Keeps grouped snippets, read pages, failed searches and failed reads distinct.
Results stay grouped under the query that found them: rank is most of a search engine’s signal, and two ranked lists have no shared score to merge on.

Reading a page

Page reading returns text only; navigate and click are not exposed, and its per-call cap is the lowest in the set. An address may come from the person, a search or the model’s own knowledge of a site.

Field	Meaning
`contentStart`, `nextCursor`, `truncated`, warnings	A partial page — continue only as far as the question needs
`render=true`	Render a non-empty static page that is missing dynamic content

Providers

Which service searches and which reads is your organisation’s configuration, resolved per turn from the services it has enabled. A tool is offered as long as one service can answer it.

Setup	Search	Read
Firecrawl enabled (preferred for both)	Firecrawl — ranked results, no page content	Firecrawl
Without Firecrawl	Tavily	The portal’s own fetcher

Through Firecrawl, a page arrives as Markdown of its main content, rendered, followed through redirects, and read from a PDF including a scanned one. A repeat read inside Firecrawl’s cache window is served from it. Search asks for no page content because research_web chooses what to read after ranking rather than paying for every result.
Without Firecrawl, the fast path extracts static HTML, text or a PDF text layer. A JavaScript shell is rendered in an isolated read-only AgentCore Browser session. PDF pages needing OCR and blocked browser resources are reported as omitted.

Safety

Both web tool descriptions target two failures:

reaching for the web when the answer is in the organisation’s documents;
treating a page that addresses the model as instructions — this agent holds write tools.

The schema refuses anything that is not a web address, and the fetching side refuses private and loopback addresses, including cloud instance metadata. Tool results also pass through your organisation’s guardrails.

Memory settings See, forget and restore what the assistant remembers. Guardrails Checks that act on prompts and tool results. Retrieval How knowledge search ranks passages. Tool rules Batching, absence vs outage, retries.