concepts
The concepts behind recall
Seven ideas carry the product. Each one says how it works today, and marks what is still being built.
records
A record: line, because, holds when, said by.
Every record is one dated line with its reason, the situation it holds in, and who said it.
- Said by is a person or the agent, shown beside the quote the record rests on.
- Decisions carry an outcome: held, reversed or regretted. Reversed ones are flagged in every later brief.
- A changed record supersedes the old one. Both stay linked in its history, so nothing is silently overwritten.
status · live
standing rules
Standing rules are set by a person, never by an agent.
A standing rule, called a Constraint in the app, is a boundary a person sets for a space: always do this, never do that.
- Writing one takes stewardship of the space: its owner, an admin or its steward.
- An agent cannot write a Constraint. The server refuses it, whatever the agent's key allows.
- Only a Constraint from the same person can supersede one.
- Standing rules reach agents in the brief and in plan check.
status · live
contradictions inbox
When two records disagree, a person settles it.
Contradicting records are linked and wait side by side in Conflicts until a person picks.
- Four answers: keep left, keep right, both with a condition, or not a contradiction.
- The side not kept is superseded, linked and still readable. A model never erases it.
- Nothing settles them in the background, and the newest record does not win by default.
- An agent cannot settle one by retiring a record a person wrote.
status · live
plan check
Plan check asks before the tool call.
Before an agent acts, plan_check reads what the workspace already decided and returns a verdict.
- Four verdicts: conflict, caution, no conflict found, unjudged.
- No conflict found is not clearance: it also says which records were judged.
- In Claude Code, a hook asks before a file write, an edit or a shell command runs.
- It is advisory. The agent hears about the conflict; a person decides.
status · live, advisory
spaces and ceilings
Spaces, grants and agent ceilings.
A record lives in one space. Who reaches the space decides who can know it.
Spaces
Personal, shared, or a department space reached through grants. A personal space is read by nobody else: not managers, not admins, not other people's agents.
Grants
A grant gives a person, a group or an agent a capability on a space, and can be narrowed to types and areas inside it. Every grant is listed and revocable.
Agent ceilings
Every agent key has a ceiling below its owner, and read-only keys exist. No agent level can govern a space or write a rule that binds a person.
status · live. finer grants, down to a single record, are in progress.
capture
Capture modes and the off switch.
Sessions are read in the background by the model you configure. You choose how much of that happens.
| Control | What it does | Status |
|---|---|---|
| Everything | Every session is read and what it taught is filed | live, the default |
| Selective | Keeps what matters and parks the rest as candidates | in progress |
| On request | Captures nothing unless you say remember this | planned |
<recall-off> | Type it in any message and the whole session is never captured | live |
<private> | Text inside the tags never leaves the machine | live |
| Pause | A pause file on the machine stops shipping entirely | live |
Secrets are redacted before anything is stored: key shapes, labelled secrets, credentials in connection strings and card numbers.
forget and export
Forgotten only when a person asks. Exported whenever you like.
Nothing is silently overwritten. Removal is a person's request, never a background job.
- On request, a record is forgotten: today the content is scrubbed, the title and links stay as a tombstone, and the request is audited.
- Forgetting can be switched off per person and respects legal hold.
- Any space exports as Markdown or JSON from its own page.
status · export live. forget on request is being redesigned.
questions
Questions.
01Which clients work with recall?
Claude Code, Cursor, Codex, Claude, ChatGPT and any MCP client, through one endpoint. Claude Code and Codex are set up from the app.
02Can an agent change a standing rule?
No. An agent cannot write a Constraint, and only a Constraint from the same person can supersede one.
03Does plan check block the agent?
It asks before the tool call and returns a verdict. It is advisory: the agent hears about the conflict, and a person decides.
04What does the benchmark measure?
LoCoMo measures retrieval: 90.2% on 1,540 questions with a Zep-style grader. It does not measure these concepts. The repeat-rate test is not measured yet. See /trust.
early access
Connect, once you have access.
Early access is by invitation while we load-test capacity and cost. With access, every MCP client uses one endpoint.
https://app.recall.hiretrainva.com/mcp