Governance
Governance in Zep lives in the substrate, not bolted on. Authorization and audit apply across every Context Graph, every query, and every layer of the Context Lake — so policy holds as you scale to thousands of agents, users, and context sources.
Zep separates two problems:
- Who can manage the account and projects — teammates in the dashboard. Solved with managing team access (role-based access control, RBAC).
- What context each agent can reach — agents and other callers that use API keys. Solved with policy-based agent access (attribute-based access control, ABAC).
Use RBAC for humans. Use policies when you need least-privilege access to context for agents. Encryption, compliance certifications, and deployment trust boundaries live under Security & Compliance.
Access and policy
Grant dashboard permissions with account- and project-scoped roles (RBAC).
Limit which actions and context each agent can reach with ABAC policies attached to its API key.
Visibility
Track dashboard member actions including logins, member management, API key changes, and data operations.
Monitor SDK and API requests, including outcomes from policy-based agent access.
Related
- Episode metadata projection — metadata attached at ingestion is what source-based policies evaluate.
- Security & Compliance — SOC 2, HIPAA, BYOK, BYOM, and deployment models.