Agent Memory Card Generator — One Prompt Turned Into a Governance Dashboard

This post is my submission for DEV Education Track: Build Apps with Google AI Studio
(https://dev.to/deved/build-apps-with-google-ai-studio).

---

What I Built

Most AI agent tools tell you what your agent can do.

Nobody tells you what your agent should be allowed to do.

That gap is where this app lives.

I built the Agent Memory Card Generator — a governance dashboard that takes an AI
agent's name, purpose, and instructions, classifies each instruction by risk level, and
generates a visual identity card showing the agent's authority posture: Safe,
Cautious, or Restricted.

The classification uses transparent heuristics, not a black box:

• High-risk / Restricted — credentials, payments, private data, irreversible actions, external communication
• Requires Verification — stale memory, user claims, third-party approvals, anything that could be outdated
• Safe to Act On — informational, reversible, formatting, summarization, internal planning

For each instruction the app outputs a classification, a reason, a recommended action
gate (answer / verify_first / block), and suggested metadata fields ready to paste
directly into an AGENTS.md or CLAUDE.md file.

The prompt I used in Google AI Studio:

▎ Build a web app called "Agent Memory Card Generator." Users enter their AI agent's
▎ name, purpose, and up to 5 key instructions. The app analyzes each instruction using
▎ transparent heuristics and classifies it as: Safe to act on, Requires verification,
▎ or High-risk / restricted. For each instruction, show the classification, reason,
▎ recommended action gate (answer / verify_first / block), and suggested metadata
▎ fields. Then generate an Imagen visual identity card showing the agent name, purpose,
▎ authority posture, and color coding: green/blue for safe, amber/blue for cautious,
▎ red/black for restricted. Output a structured authority summary and a plain-text
▎ exportable report formatted for AGENTS.md or CLAUDE.md. All classification logic runs
▎ client-side. Imagen handles the visual card server-side with a polished CSS fallback
▎ when the API is unavailable.

One prompt. One build pass. The result was a full-stack app with a client-side
heuristics engine, server-side Imagen integration, CSS fallback card, and a one-click
exportable markdown report.

---

Demo

Live app: Agent Memory Card Generator
(https://agent-memory-card-generator-992750435781.us-west2.run.app/)

Test it yourself with this input:

Agent Name: Atlas Support Agent
Purpose: Helps a small business owner manage customer support, payments, and internal
operations.

Instructions:

1. Answer customer questions using saved company notes.
2. Check payment records before answering refund questions.
3. Never reveal API keys, passwords, or private customer data.
4. Verify against the ledger before sending payment confirmation.
5. Summarize support tickets at the end of each day.

What the app produced on this input:

• Instruction 1 → Safe / answer
• Instruction 2 → Requires Verification / verify_first
• Instruction 3 → High-risk / block
• Instruction 4 → Requires Verification / verify_first
• Instruction 5 → Safe / answer
• Overall posture: Cautious (amber)

Then try swapping the instructions for something lower-stakes — a sports headline
summarizer or a daily agenda planner — and watch the posture shift from Restricted to
Safe in real time. That proportional response is the point.

---

My Experience

The build itself took one prompt and one pass. The rest was testing, deployment, and
validation.

What I didn't expect: the classification engine responds proportionally, not uniformly.
A sports-summary agent lands Safe — five instructions, zero verifications, zero
restrictions. An agent handling credentials, payments, and customer data lands
Restricted. A mixed-risk agent lands Cautious. The posture tracks the actual risk
profile of the instruction set, not just the presence of a single risky word.

That matters more than it sounds. Most governance tools are binary: allowed or not.
This one produces a gradient, which is closer to how real agent risk actually works.

The surprise that stuck with me: the exported report formats directly into AGENTS.md
and CLAUDE.md syntax. The output isn't just a visualization — it's something you can
act on immediately. Copy it, paste it into your agent configuration file, and your
memory store has structured authority metadata from the start.

This connects to a larger body of work I've been building on AI agent memory. The core
finding: retrieval systems select the most relevant memory, but relevance and authority
are different things. An agent can retrieve the right instruction and still take the
wrong action if that instruction has no metadata telling the system what it's
authorized to govern.

The card generator makes that distinction visible before the agent runs. The next step
is connecting generation to audit: one tool helps create authority-aware instructions,
while an auditor workflow can inspect existing AGENTS.md or CLAUDE.md files for stale,
loose, or missing authority metadata. That fuller picture is what I'm building toward.

If you test it — what posture does your agent land on?