# Vault and server-owned identity
AMEM_VAULT=/absolute/path/to/memory-vault
AMEM_ACTOR_ID=workspace-agent
AMEM_ACTOR_NAME=Workspace Agent
AMEM_ACTOR_EMAIL=workspace-agent@example.invalid

# Least-privilege policy (MCP defaults to read-only when omitted)
AMEM_PERMISSIONS=read,write,review
AMEM_ALLOWED_SCOPES=user,project
AMEM_MAX_SENSITIVITY=internal
# Required for every non-admin principal; copy tenantId from agent-memory.json
AMEM_TENANT_ID=replace-with-vault-tenant-id

# Supply from a secret manager; never commit a real value
# AMEM_MASTER_KEY=64-hex-characters-or-32-byte-base64

# Optional OpenAI-compatible extraction, Q&A, and embeddings
# AMEM_LLM_API_KEY=provider-secret
AMEM_LLM_MODEL=gpt-4.1-mini
AMEM_LLM_BASE_URL=https://api.openai.com/v1
# AMEM_EMBEDDING_MODEL=text-embedding-3-small
# AMEM_LLM_TIMEOUT_MS=30000
# AMEM_LLM_MAX_RESPONSE_BYTES=2000000
# AMEM_LLM_MAX_RETRIES=1