Resource Cache

Every admin page and every partner site reads the same thing: your organization's configuration — Spaces and the Agents inside them, API Keys and their Clients, Certificates, Consumer Contracts, and each contract's consumer policy. KeenAgents keeps a ready-to-serve copy of that configuration so those reads are instant and never wait on a slow lookup. You do not create or manage this copy — it exists so the product feels immediate.

The one guarantee that matters: the served copy is kept current for you. The moment you create, edit or delete a record, the copy updates — the next page load and the next partner fetch see the change, with no step on your part. The controls on this page exist only for the rare case where you want to force that refresh yourself.

Always current

A change you make is reflected right away — there is no refresh interval to wait out. Saving an agent, rebinding an API key or editing a contract is visible to admins and to partner sites immediately.

Tenant isolation

A partner only ever receives the resources bound to its own API key — its spaces, its agents, its contract and policy. One tenant can never read another's configuration; the served copy is filtered to the caller every time.

Self-healing

The served copy cannot drift from the truth for long: it is re-checked on a steady cadence and after any interruption, so even in an edge case it settles back to what your records actually say. You should never need the manual controls below to keep it correct — they are a convenience, not a repair.

Both surfaces below are gated by a single permission: cache for read (see status), cache:w for write (rebuild or clear). Without the write grant the action buttons do not appear.

• The Cache page (System → Cache) — one card per resource with its live status: whether a ready-to-serve copy is present, how many records it holds, when it was last built, and the progress of any build in flight. From here you can Rebuild a resource (build a fresh copy and swap it in atomically — readers see the old copy or the new one, never a half-built mix) or Invalidate it (clear the copy; it is rebuilt on the next change or rebuild).
• The Rebuild Resource Cache button — on the detail page of every record that has a served copy (Api Key, Client, Certificate, Contract, Webhook, Space, Agent). It rebuilds that record's resource without a trip to the Cache page. A Contract rebuilds both its contract data and its consumer policy; a Webhook rebuilds the API-key data its details live on.

The Cache page — one card per resource showing whether a served copy is present, how many records it holds, and the Rebuild and Invalidate actions.

An example resource card — the served copy of your agents, with its record count and last-built status.

1. Never, for a normal edit. Creating, editing, deleting, binding or unbinding a record already refreshes the served copy on its own. Reaching for Rebuild after a normal Save is redundant.
2. To force a refresh you're unsure landed — for example after a large batch of changes, or if a partner reports stale configuration. Rebuild the affected resource and re-check its status.
3. To clear a copy on purpose — Invalidate removes the served copy so nothing is served until the next build. Use it deliberately; a partner reading that resource in the gap gets an empty result until the copy is rebuilt.

A partner site reads its configuration — spaces, agents, contract, policy, agent front settings — over the authenticated API, served from the same ready-to-serve copy. Because that copy is kept current, a change an admin makes is reflected the next time the site fetches. To avoid polling, KeenAgents also notifies the site when something it depends on changes: a notice is POSTed to the site's webhook URL (and the admin's Wake action sends the same notice on demand), and the site re-fetches the affected resources. The notice carries no data — it is a hint to re-read (notify-then-fetch).