Iris docs: align Agent Memory and Identity Service self-managed docs with the operator runbooks

content/operate/iris/agent-memory/self-managed/_index.md

@@ -31,9 +31,11 @@ documents the self-managed admin endpoints for stores.
 
 ## What you are deploying
 
-The `redis-agent-memory` chart `0.10.2` deploys the Data Plane, workers, and Control Plane.
-Install the `iris-identity-service` chart `0.10.2` as a separate release first, then connect
+The `redis-agent-memory` chart `1.0.0` deploys the Data Plane, workers, and Control Plane.
+Install the `iris-identity-service` chart `1.0.0` as a separate release first, then connect
 Memory to it. Memory does not deploy Identity Service resources or include it as a subchart.
+A unified Redis Iris chart that installs Memory and Identity Service as one release is planned.
+These pages document the separate releases.
 You provide the Redis databases. Follow [Deploy](/content/operate/iris/agent-memory/self-managed/deploy.md)
 to configure both releases.
 

content/operate/iris/agent-memory/self-managed/api-examples.md

@@ -47,11 +47,14 @@ curl -sS -X POST "$CP_URL/iris/v1/agent-memory/stores" \
   -H "Content-Type: application/json" \
   -d '{
     "name": "my-store",
-    "database": { "databaseId": "<database-id>" }
+    "database": { "databaseId": "1" }
   }'
 ```
 
-<!-- TODO: The unified Control Plane spec requires `database.databaseId` on CreateStore and does not mark it Redis Cloud only. Confirm which database ID a self-managed deployment accepts here, and whether the exclusions example also needs it. -->
+`database.databaseId` is required on every create request. It names an entry in the
+`databases` registry of the Data Plane and Control Plane configuration. The
+[deploy walkthrough](/content/operate/iris/agent-memory/self-managed/deploy.md#3-create-ram-valuesyaml)
+configures one entry, `"1"`.
 
 The response is the full store record. It includes these fields, among others:
 
@@ -95,6 +98,7 @@ curl -sS -X POST "$CP_URL/iris/v1/agent-memory/stores" \
   -H "Content-Type: application/json" \
   -d '{
     "name": "my-store",
+    "database": { "databaseId": "1" },
     "longTermMemoryExclusions": {
       "enabled": true,
       "builtInDetectors": {
@@ -396,12 +400,13 @@ Agent-key fields:
 | Endpoint | Use `/v1/api-keys`. |
 | `name` | Required. |
 | `grants` | Required. |
-| `tenant` | Your tenant ID. Use the same tenant on every grant of a key. Any string is accepted. Use `1` if you manage stores with the Control Plane admin token. |
+| `tenant` | The installation's tenant: the same value as Memory's `tenantId` and the Identity Service's `runtime.apiKeyTenant.singleTenantID`, for example `default`. Use the same tenant on every grant of a key. When `singleTenantID` is set, an omitted `tenant` gets that value and any other tenant returns `400`. |
 | `product` | Use `memory`. |
 | `resourceType` | Use `mem-store`. |
 | `resourceId` | Set to the store ID. |
 | `actions` | Use `read`, `write`, or both. |
 | `expiresAt` | Optional. Unix seconds after which the key stops authenticating. `0` or omitted means never. |
+| `userId` | Optional. The user that owns the key. Requires `apiKeys.userBinding.enabled: true` on the Identity Service release. |
 | Token | Returned only when you mint or rotate a key. Store it immediately. |
 
 List agent keys:
@@ -457,7 +462,7 @@ Response:
 
 Rotation returns a new `keyId` with the new token. Use the new `keyId` for later updates,
 rotations, and revocations. The old key stays valid for `graceSeconds`, which defaults to 3600 and
-has a chart maximum of 604800 (`identityService.apiKeys.maxRotateGraceSeconds`). `oldExpiresAt` is
+has a chart maximum of 604800 (`apiKeys.maxRotateGraceSeconds` on the Identity Service release). `oldExpiresAt` is
 when the old key stops working. Revoking the old `keyId` ends its grace period early.
 
 Revoke an agent key:

content/operate/iris/agent-memory/self-managed/authentication.md

@@ -154,7 +154,7 @@ Operation mapping:
 
 Store grants authorize access to a store. Ownership enforcement adds a check within that store: ordinary callers can access their own personal records and shared records.
 
-This section applies to on-prem deployments. Release 0.10.2 enables ownership enforcement by default in the on-prem server, worker, and chart.
+This section applies to on-prem deployments. Ownership enforcement is off by default in the on-prem server, worker, and chart. Turn it on with `memory.ownership.enabled: true` after you configure a user identity; see [Enable or change ownership enforcement](#enable-or-change-ownership-enforcement).
 
 | Setting | Personal access | Shared access |
 | --- | --- | --- |
@@ -176,13 +176,13 @@ With enforcement on:
 - A personal namespace child inherits its root's owner.
 - A caller without a user ID can access shared records within its grants, but cannot claim a named personal owner. Ownerless private records are hidden.
 
-Ordinary agent keys created by `POST /v1/api-keys` do not contain a user binding. The API does not accept one or copy the key creator's identity. Use delegation for personal access. Configuring an OpenID Connect (OIDC) claim alone does not bind a key.
+Agent keys created by `POST /v1/api-keys` have no user binding by default, and a key never copies its creator's identity. To bind a key to one user, set `apiKeys.userBinding.enabled: true` on the Identity Service release (default `false`) and send `userId` when you mint the key. The control token and a `suite_admin` can set any user ID; other callers can set only their own. The Data Plane then uses that user ID for the key's requests. For an application that acts for many users, use delegation instead. Configuring an OpenID Connect (OIDC) claim alone does not bind a key.
 
 An unbound key can pass store health checks and access allowed shared data while personal creation returns `403`. A successful health check does not establish a user identity.
 
 ### Delegate a user with an agent key
 
-Delegation lets an application use its agent key for store permissions and a user's access token for personal identity. This path is supported in on-prem release 0.10.2. It does not add the user's store grants to the key.
+Delegation lets an application use its agent key for store permissions and a user's access token for personal identity. This path is supported in on-prem release 1.0.0. It does not add the user's store grants to the key.
 
 1. Configure your identity provider to issue signed access tokens with an issuer, a compatible user ID claim, and the intended audience. Obtain the user's token through your application's login process.
 1. Configure the Data Plane to trust that issuer and its JSON Web Key Set (JWKS). Use the same tenant as the agent key and store.
@@ -294,7 +294,7 @@ A missing or invalid primary credential, an invalid or expired user token, or a
 
 ### Enable or change ownership enforcement
 
-For a new deployment, configure the user-identity path before writing personal data. If your application does not use a trusted identity provider, explicitly disable enforcement and apply [backend authorization](/content/develop/ai/context-engine/agent-memory/developer-guide.md#authorize-every-memory-request).
+For a new deployment that enables enforcement, configure the user-identity path before writing personal data. If your application does not use a trusted identity provider, leave enforcement off and apply [backend authorization](/content/develop/ai/context-engine/agent-memory/developer-guide.md#authorize-every-memory-request).
 
 Before upgrading an existing deployment:
 

content/operate/iris/agent-memory/self-managed/configuration.md

@@ -43,7 +43,7 @@ Data Plane settings go under `memory`, or at the top level of a BYO Data Plane c
 | `databases` | Required. Store Redis, as `databases."1".urls`. |
 | `embedding.models.default_embedding_model`, `embedding.models.dimensions` | Required. The embedding model and its vector size. The Control Plane's `embedding.dimensions` must match. |
 | `auth` | Data Plane authentication. Defaults to `agent_key`. |
-| `ownership.enabled` | Restricts personal records to their authenticated owner while allowing shared records. Defaults to `true` in on-prem release 0.10.2. Requires a matching authenticated user ID for personal access; use an agent key with a delegated user token, or explicitly disable enforcement and authorize requests in your backend. See [Server-side ownership enforcement](/content/operate/iris/agent-memory/self-managed/authentication.md#server-side-ownership-enforcement) before enabling it. |
+| `ownership.enabled` | Restricts personal records to their authenticated owner while allowing shared records. Defaults to `false`. When enabled, personal access requires a matching authenticated user ID, such as an agent key with a delegated user token. With it off, authorize requests in your backend. See [Server-side ownership enforcement](/content/operate/iris/agent-memory/self-managed/authentication.md#server-side-ownership-enforcement) before enabling it. |
 | `inference_providers` | Required when any `llm` block is set. Each entry holds a provider's `endpoint`. |
 | `server` | Data Plane bind address and port. |
 | `license.license_path` | Path where the license Secret is mounted. |
@@ -279,19 +279,53 @@ TLS proxies. See [Network policy](/content/operate/iris/agent-memory/self-manage
 
 ## Optional Agent Playbooks extraction
 
-On the Identity Service release, allow Memory subject grants for Agent Playbooks extraction:
+Agent Playbooks extraction needs no Identity Service subject grants or extra runtime
+operations. Memory trusts the Agent Playbooks workloads through their projected service
+account tokens instead.
+
+On the Data Plane, trust the Agent Playbooks extraction worker as a static read-only subject.
+Add the entry to `memory.auth.jwt_subjects` next to your existing authentication settings;
+keep agent-key authentication and the Memory worker identity:
+
+```yaml
+memory:
+  auth:
+    method: agent_key
+    jwt_subjects:
+      - issuer: <service-account-issuer>
+        jwks_uri: https://kubernetes.default.svc/openid/v1/jwks
+        audience: [api://memory-dp]
+        subjects:
+          - subject: system:serviceaccount:<namespace-name>:<playbook-fullname>-worker
+            authority: static
+            roles: [viewer]
+            resources:
+              "mem-store:*": {permissions: [read]}
+```
+
+On the Control Plane, trust the Agent Playbooks control plane as a viewer in one tenant, so it
+can list and read source stores. Use the same tenant as the Agent Playbooks `tenantId`. Don't
+give it `suite_admin`, which bypasses Memory's ownership checks:
 
 ```yaml
-subjectGrants:
-  allowed:
-    - product: memory
-      resourceType: mem-store
-      actions: [read, read_all_owners]
+controlplane:
+  configData:
+    auth:
+      workload_identity:
+        enabled: true
+        issuer: <service-account-issuer>
+        jwks_uri: https://kubernetes.default.svc/openid/v1/jwks
+        audience: [api://memory-cp]
+        subjects:
+          - subject: system:serviceaccount:<namespace-name>:<playbook-fullname>-controlplane
+            tenant: "<playbook-tenant-id>"
+            roles: [viewer]
 ```
 
-Also add `subject-grant-lookup` to the `memory-dp` runtime credential's `allowedOperations`
-alongside `api-key-introspect`. These are Identity Service values, not Memory's `identityService`
-values. `read_all_owners` is a subject-grant action; do not add it to agent-key grants.
+`<playbook-fullname>` is the Agent Playbooks release's resource name prefix. Both Memory planes
+must reach the issuer's JWKS and trust its CA; see
+[worker identity](/content/operate/iris/agent-memory/self-managed/deploy.md#prepare-worker-identity-for-your-platform).
+Helm replaces lists, so merge these entries with any existing ones.
 
 ## Configure document ingestion {#enable-document-ingestion}
 

content/operate/iris/agent-memory/self-managed/deploy.md

@@ -22,7 +22,7 @@ These steps install Redis Agent Memory with chart-rendered configuration and age
 authentication, and end with one authenticated call to the Data Plane.
 
 Install Identity Service as release `ids`, then Memory as release `redis-agent-memory`.
-These steps use Memory chart `0.10.2` and Identity Service chart `0.10.2` in one namespace.
+These steps use Memory chart `1.0.0` and Identity Service chart `1.0.0` in one namespace.
 You create the shared credentials and Identity Service control token; Memory generates its
 Control Plane admin token. See [Credentials](/content/operate/iris/agent-memory/self-managed/authentication.md#credentials).
 
@@ -33,7 +33,7 @@ placeholders with addresses reachable from the calling pods. Obtain their certif
 (CA) certificates as a PEM bundle named `service-ca.crt`; use your organization's trust bundle
 if the endpoints use public certificates.
 
-Ownership enforcement is on by default. Before using an agent key with personal memories, [configure delegated user identity](/content/operate/iris/agent-memory/self-managed/authentication.md#delegate-a-user-with-an-agent-key). Applications that authorize users entirely in their backend must explicitly disable ownership enforcement in their Helm values.
+Ownership enforcement is off by default, so your backend must authorize each user's access to personal memories. To have the server enforce owners, [configure delegated user identity](/content/operate/iris/agent-memory/self-managed/authentication.md#delegate-a-user-with-an-agent-key) and set `memory.ownership.enabled: true`.
 
 Before you begin, review the [prerequisites](/content/operate/iris/agent-memory/self-managed/prerequisites.md).
 
@@ -160,7 +160,7 @@ tls:
 helm repo add redis-ai https://helm.redis.io/ai
 helm repo update redis-ai
 helm install ids redis-ai/iris-identity-service \
-  --version 0.10.2 \
+  --version 1.0.0 \
   --namespace <namespace-name> \
   -f values-ids.yaml
 ```
@@ -307,12 +307,12 @@ memory:
   session_summarisation:
     enabled: false
 image:
-  tag: "0.10.2"
+  tag: "1.0.0"
 controlplane:
   internalToken:
     existingSecret: memory-internal-token
   image:
-    tag: "0.10.2"
+    tag: "1.0.0"
   config:
     render: true
   configData:
@@ -347,7 +347,7 @@ tls:
   `/etc/identity-service/runtime/memory-dp/token`. Do not hand-set the introspection endpoint or credential under `memory.auth` or `shared.auth`.
 - `tenantId: default` matches `runtime.apiKeyTenant.singleTenantID` in `values-ids.yaml`.
   The Control Plane creates admin-token stores in this tenant.
-- Both charts use application version `0.10.2`. The example pins Memory's Data Plane
+- Both charts use application version `1.0.0`. The example pins Memory's Data Plane
   and Control Plane images to that version.
 
 {{< note >}}
@@ -376,7 +376,7 @@ its row. The rows are checklist items CL-1 to CL-6.
 helm repo add redis-ai https://helm.redis.io/ai
 helm repo update redis-ai
 helm install redis-agent-memory redis-ai/redis-agent-memory \
-  --version 0.10.2 \
+  --version 1.0.0 \
   --namespace <namespace-name> \
   -f ram-values.yaml
 kubectl -n <namespace-name> get pods -w
@@ -388,7 +388,7 @@ If you want Helm to wait, set an explicit timeout that matches the environment:
 
 ```bash
 helm install redis-agent-memory redis-ai/redis-agent-memory \
-  --version 0.10.2 \
+  --version 1.0.0 \
   --namespace <namespace-name> \
   -f ram-values.yaml \
   --wait \
@@ -437,12 +437,11 @@ RAM_ADMIN_TOKEN=$(kubectl -n <namespace-name> get secret \
 curl -sS -X POST http://localhost:9100/iris/v1/agent-memory/stores \
   -H "Authorization: Bearer $RAM_ADMIN_TOKEN" \
   -H "Content-Type: application/json" \
-  -d '{"name": "my-store", "database": {"databaseId": "<database-id>"}}'
+  -d '{"name": "my-store", "database": {"databaseId": "1"}}'
 ```
 
-The response carries `storeId`.
-
-<!-- TODO: The unified Control Plane spec requires `database.databaseId` on CreateStore. Confirm which database ID a self-managed deployment accepts. -->
+`database.databaseId` is required. It names an entry in the `databases` registry, here `"1"` from
+`shared.databases` in [step 3](#3-create-ram-valuesyaml) and the overlay. The response carries `storeId`.
 
 ## 7. Mint an agent key
 

content/operate/iris/agent-memory/self-managed/operations.md

@@ -82,12 +82,12 @@ kubectl -n <namespace-name> create secret generic memory-dp-credential \
 RUNTIME_CREDENTIAL_CHECKSUM="$(shasum -a 256 ./memory-dp-token | awk '{print $1}')"
 
 helm upgrade ids redis-ai/iris-identity-service \
-  --version 0.10.2 \
+  --version 1.0.0 \
   --namespace <namespace-name> \
   -f values-ids.yaml \
   --set-string "runtime.serviceCredentials[0].existingSecretChecksum=$RUNTIME_CREDENTIAL_CHECKSUM"
 helm upgrade redis-agent-memory redis-ai/redis-agent-memory \
-  --version 0.10.2 \
+  --version 1.0.0 \
   --namespace <namespace-name> \
   -f ram-values.yaml \
   --set-string "identityService.credential.existingSecretChecksum=$RUNTIME_CREDENTIAL_CHECKSUM"
@@ -174,8 +174,7 @@ kubectl -n <namespace-name> rollout restart deployment
 
 Memory and Identity Service have independent release versions. Upgrade each with its own
 values file and verify their shared connection contract afterward. A Memory upgrade does not
-upgrade Identity Service. The published pair documented here is Memory `0.10.2` and Identity
-Service `0.10.2`.
+upgrade Identity Service. The pair documented here is Memory `1.0.0` and Identity Service `1.0.0`.
 
 For updates within a supported release path:
 
@@ -287,15 +286,15 @@ Memory also ships a `values-fips.yaml` overlay. Apply it only to Memory, and con
 Identity Service release's posture separately:
 
 ```bash
-helm pull redis-ai/redis-agent-memory --version 0.10.2 --untar
+helm pull redis-ai/redis-agent-memory --version 1.0.0 --untar
 helm upgrade redis-agent-memory redis-ai/redis-agent-memory \
-  --version 0.10.2 \
+  --version 1.0.0 \
   --namespace <namespace-name> \
   -f ram-values.yaml \
   -f redis-agent-memory/values-fips.yaml
 
 helm upgrade ids redis-ai/iris-identity-service \
-  --version 0.10.2 \
+  --version 1.0.0 \
   --namespace <namespace-name> \
   -f values-ids.yaml
 ```
@@ -346,7 +345,7 @@ the direct caller also has a valid Redis Agent Memory credential.
 
 The chart includes `networkpolicy.reference.yaml` at the chart root as a
 reference manifest. Get it with
-`helm pull redis-ai/redis-agent-memory --version 0.10.2 --untar`. It is not templated because allowed callers are
+`helm pull redis-ai/redis-agent-memory --version 1.0.0 --untar`. It is not templated because allowed callers are
 environment-specific.
 
 Customize the placeholders before applying it: