refactor(agent-memory): rename AccessStrategy values and add PROVIDER warning

- SUBSCRIBER_ONLY → SUBSCRIBER, PROVIDER_ONLY → PROVIDER across all
  agent_memory source, tests, feature files, and user guide
- Add logger.warning() when AccessStrategy.PROVIDER is used, making
  the no-isolation behaviour explicit at runtime

Author: cassiofariasmachado

src/sap_cloud_sdk/agent_memory/__init__.py

@@ -9,7 +9,7 @@
 
     # Subscriber tenant — strategy and tenant set once, inherited by all calls
     client = create_client(
-        access_strategy=AccessStrategy.SUBSCRIBER_ONLY,
+        access_strategy=AccessStrategy.SUBSCRIBER,
         tenant="my-tenant-subdomain",
     )
     memories = client.list_memories(agent_id="my-agent", invoker_id="user-123")
@@ -41,7 +41,7 @@
 def create_client(
     *,
     config: Optional[AgentMemoryConfig] = None,
-    access_strategy: AccessStrategy = AccessStrategy.SUBSCRIBER_ONLY,
+    access_strategy: AccessStrategy = AccessStrategy.SUBSCRIBER,
     tenant: Optional[str] = None,
 ) -> AgentMemoryClient:
     """Create an :class:`AgentMemoryClient` with automatic credential detection.
@@ -52,18 +52,18 @@ def create_client(
                 ``/etc/secrets/appfnd/hana-agent-memory/default/`` or from
                 ``CLOUD_SDK_CFG_AGENT_MEMORY_DEFAULT_*`` environment variables.
         access_strategy: Default tenant access strategy for all client operations.
-                Defaults to ``SUBSCRIBER_ONLY``. Individual method calls may override
+                Defaults to ``SUBSCRIBER``. Individual method calls may override
                 this value.
         tenant: Default subscriber tenant subdomain. Required when
-                ``access_strategy=SUBSCRIBER_ONLY``. Individual method calls may
+                ``access_strategy=SUBSCRIBER``. Individual method calls may
                 override this value.
 
     Returns:
         A ready-to-use :class:`AgentMemoryClient`.
 
     Raises:
         AgentMemoryConfigError: If configuration is missing, invalid, or
-            ``access_strategy=SUBSCRIBER_ONLY`` is used without a ``tenant``.
+            ``access_strategy=SUBSCRIBER`` is used without a ``tenant``.
     """
     try:
         resolved_config = config if config is not None else _load_config_from_env()

src/sap_cloud_sdk/agent_memory/_models.py

@@ -18,8 +18,8 @@
 class AccessStrategy(str, Enum):
     """Access strategy for tenant-scoped Agent Memory operations."""
 
-    SUBSCRIBER_ONLY = "SUBSCRIBER_ONLY"
-    PROVIDER_ONLY = "PROVIDER_ONLY"
+    SUBSCRIBER = "SUBSCRIBER"
+    PROVIDER = "PROVIDER"
 
 
 class MessageRole(str, Enum):

src/sap_cloud_sdk/agent_memory/client.py

@@ -9,6 +9,7 @@
 
 from __future__ import annotations
 
+import logging
 from typing import Any, Optional
 
 from sap_cloud_sdk.agent_memory._endpoints import (
@@ -38,6 +39,8 @@
 )
 from sap_cloud_sdk.core.telemetry import Module, Operation, record_metrics
 
+logger = logging.getLogger(__name__)
+
 
 def _require_non_empty(**fields: str) -> None:
     """Raise AgentMemoryValidationError if any named field is an empty string."""
@@ -76,16 +79,16 @@ class AgentMemoryClient:
     Args:
         transport: HTTP transport layer (injected by ``create_client``).
         access_strategy: Default tenant access strategy for all operations.
-            Defaults to ``SUBSCRIBER_ONLY``. Can be overridden per method call.
+            Defaults to ``SUBSCRIBER``. Can be overridden per method call.
         tenant: Default subscriber tenant subdomain. Required when
-            ``access_strategy=SUBSCRIBER_ONLY``. Can be overridden per method call.
+            ``access_strategy=SUBSCRIBER``. Can be overridden per method call.
     """
 
     def __init__(
         self,
         transport: HttpTransport,
         *,
-        access_strategy: AccessStrategy = AccessStrategy.SUBSCRIBER_ONLY,
+        access_strategy: AccessStrategy = AccessStrategy.SUBSCRIBER,
         tenant: Optional[str] = None,
     ) -> None:
         self._transport = transport
@@ -112,7 +115,7 @@ def _resolve_tenant(
         Per-call parameters take precedence over instance defaults.
 
         Raises:
-            AgentMemoryValidationError: If the effective strategy is ``SUBSCRIBER_ONLY``
+            AgentMemoryValidationError: If the effective strategy is ``SUBSCRIBER``
                 but no tenant is available.
         """
         effective_strategy = (
@@ -122,16 +125,18 @@ def _resolve_tenant(
         )
         effective_tenant = tenant if tenant is not None else self._default_tenant
 
-        if (
-            effective_strategy is AccessStrategy.SUBSCRIBER_ONLY
-            and not effective_tenant
-        ):
+        if effective_strategy is AccessStrategy.SUBSCRIBER and not effective_tenant:
             raise AgentMemoryValidationError(
-                "tenant is required when access_strategy=SUBSCRIBER_ONLY"
+                "tenant is required when access_strategy=SUBSCRIBER"
+            )
+        if effective_strategy is not AccessStrategy.SUBSCRIBER:
+            logger.warning(
+                "AccessStrategy.PROVIDER is active: no tenant isolation will be applied. "
+                "Only use this strategy for provider-owned operations."
             )
         return (
             effective_tenant
-            if effective_strategy is AccessStrategy.SUBSCRIBER_ONLY
+            if effective_strategy is AccessStrategy.SUBSCRIBER
             else None
         )
 
@@ -158,14 +163,14 @@ def add_memory(
             access_strategy: Tenant access strategy. Overrides the client default when
                 provided. Falls back to the default set on :func:`create_client`.
             tenant: Subscriber tenant subdomain. Overrides the client default when
-                provided. Required (at call or client level) when strategy is ``SUBSCRIBER_ONLY``.
+                provided. Required (at call or client level) when strategy is ``SUBSCRIBER``.
 
         Returns:
             The created :class:`Memory`.
 
         Raises:
             AgentMemoryValidationError: If any required field is empty or tenant is missing
-                for ``SUBSCRIBER_ONLY``.
+                for ``SUBSCRIBER``.
             AgentMemoryHttpError: If the request fails.
         """
         _require_non_empty(agent_id=agent_id, invoker_id=invoker_id, content=content)
@@ -197,15 +202,15 @@ def get_memory(
             access_strategy: Tenant access strategy. Overrides the client default when
                 provided. Falls back to the default set on :func:`create_client`.
             tenant: Subscriber tenant subdomain. Overrides the client default when
-                provided. Required (at call or client level) when strategy is ``SUBSCRIBER_ONLY``.
+                provided. Required (at call or client level) when strategy is ``SUBSCRIBER``.
 
         Returns:
             The :class:`Memory`.
 
         Raises:
             AgentMemoryNotFoundError: If no memory with the given ID exists.
             AgentMemoryValidationError: If ``memory_id`` is empty or tenant is missing
-                for ``SUBSCRIBER_ONLY``.
+                for ``SUBSCRIBER``.
             AgentMemoryHttpError: If the request fails.
         """
         _require_non_empty(memory_id=memory_id)
@@ -234,12 +239,12 @@ def update_memory(
             access_strategy: Tenant access strategy. Overrides the client default when
                 provided. Falls back to the default set on :func:`create_client`.
             tenant: Subscriber tenant subdomain. Overrides the client default when
-                provided. Required (at call or client level) when strategy is ``SUBSCRIBER_ONLY``.
+                provided. Required (at call or client level) when strategy is ``SUBSCRIBER``.
 
         Raises:
             AgentMemoryNotFoundError: If no memory with the given ID exists.
             AgentMemoryValidationError: If ``memory_id`` is empty, no fields are provided,
-                or tenant is missing for ``SUBSCRIBER_ONLY``.
+                or tenant is missing for ``SUBSCRIBER``.
             AgentMemoryHttpError: If the request fails.
         """
         _require_non_empty(memory_id=memory_id)
@@ -272,12 +277,12 @@ def delete_memory(
             access_strategy: Tenant access strategy. Overrides the client default when
                 provided. Falls back to the default set on :func:`create_client`.
             tenant: Subscriber tenant subdomain. Overrides the client default when
-                provided. Required (at call or client level) when strategy is ``SUBSCRIBER_ONLY``.
+                provided. Required (at call or client level) when strategy is ``SUBSCRIBER``.
 
         Raises:
             AgentMemoryNotFoundError: If no memory with the given ID exists.
             AgentMemoryValidationError: If ``memory_id`` is empty or tenant is missing
-                for ``SUBSCRIBER_ONLY``.
+                for ``SUBSCRIBER``.
             AgentMemoryHttpError: If the request fails.
         """
         _require_non_empty(memory_id=memory_id)
@@ -313,14 +318,14 @@ def list_memories(
             access_strategy: Tenant access strategy. Overrides the client default when
                 provided. Falls back to the default set on :func:`create_client`.
             tenant: Subscriber tenant subdomain. Overrides the client default when
-                provided. Required (at call or client level) when strategy is ``SUBSCRIBER_ONLY``.
+                provided. Required (at call or client level) when strategy is ``SUBSCRIBER``.
 
         Returns:
             List of :class:`Memory` objects.
 
         Raises:
             AgentMemoryValidationError: If ``limit`` < 1, ``offset`` < 0, a filter
-                clause is invalid, or tenant is missing for ``SUBSCRIBER_ONLY``.
+                clause is invalid, or tenant is missing for ``SUBSCRIBER``.
             AgentMemoryHttpError: If the request fails.
         """
         if limit < 1:
@@ -362,13 +367,13 @@ def count_memories(
             access_strategy: Tenant access strategy. Overrides the client default when
                 provided. Falls back to the default set on :func:`create_client`.
             tenant: Subscriber tenant subdomain. Overrides the client default when
-                provided. Required (at call or client level) when strategy is ``SUBSCRIBER_ONLY``.
+                provided. Required (at call or client level) when strategy is ``SUBSCRIBER``.
 
         Returns:
             Total number of matching memories.
 
         Raises:
-            AgentMemoryValidationError: If tenant is missing for ``SUBSCRIBER_ONLY``.
+            AgentMemoryValidationError: If tenant is missing for ``SUBSCRIBER``.
             AgentMemoryHttpError: If the request fails.
         """
         tenant_subdomain = self._resolve_tenant(access_strategy, tenant)
@@ -406,15 +411,15 @@ def search_memories(
             access_strategy: Tenant access strategy. Overrides the client default when
                 provided. Falls back to the default set on :func:`create_client`.
             tenant: Subscriber tenant subdomain. Overrides the client default when
-                provided. Required (at call or client level) when strategy is ``SUBSCRIBER_ONLY``.
+                provided. Required (at call or client level) when strategy is ``SUBSCRIBER``.
 
         Returns:
             List of :class:`SearchResult` objects.
 
         Raises:
             AgentMemoryValidationError: If required fields are empty, parameters are
                 out of range (``query`` must be 5–5000 chars, ``threshold`` 0.0–1.0,
-                ``limit`` 1–50), or tenant is missing for ``SUBSCRIBER_ONLY``.
+                ``limit`` 1–50), or tenant is missing for ``SUBSCRIBER``.
             AgentMemoryHttpError: If the request fails.
         """
         _require_non_empty(agent_id=agent_id, invoker_id=invoker_id, query=query)
@@ -470,14 +475,14 @@ def add_message(
             access_strategy: Tenant access strategy. Overrides the client default when
                 provided. Falls back to the default set on :func:`create_client`.
             tenant: Subscriber tenant subdomain. Overrides the client default when
-                provided. Required (at call or client level) when strategy is ``SUBSCRIBER_ONLY``.
+                provided. Required (at call or client level) when strategy is ``SUBSCRIBER``.
 
         Returns:
             The created :class:`Message`.
 
         Raises:
             AgentMemoryValidationError: If any required field is empty or tenant is missing
-                for ``SUBSCRIBER_ONLY``.
+                for ``SUBSCRIBER``.
             AgentMemoryHttpError: If the request fails.
         """
         _require_non_empty(
@@ -516,15 +521,15 @@ def get_message(
             access_strategy: Tenant access strategy. Overrides the client default when
                 provided. Falls back to the default set on :func:`create_client`.
             tenant: Subscriber tenant subdomain. Overrides the client default when
-                provided. Required (at call or client level) when strategy is ``SUBSCRIBER_ONLY``.
+                provided. Required (at call or client level) when strategy is ``SUBSCRIBER``.
 
         Returns:
             The :class:`Message`.
 
         Raises:
             AgentMemoryNotFoundError: If no message with the given ID exists.
             AgentMemoryValidationError: If ``message_id`` is empty or tenant is missing
-                for ``SUBSCRIBER_ONLY``.
+                for ``SUBSCRIBER``.
             AgentMemoryHttpError: If the request fails.
         """
         _require_non_empty(message_id=message_id)
@@ -549,12 +554,12 @@ def delete_message(
             access_strategy: Tenant access strategy. Overrides the client default when
                 provided. Falls back to the default set on :func:`create_client`.
             tenant: Subscriber tenant subdomain. Overrides the client default when
-                provided. Required (at call or client level) when strategy is ``SUBSCRIBER_ONLY``.
+                provided. Required (at call or client level) when strategy is ``SUBSCRIBER``.
 
         Raises:
             AgentMemoryNotFoundError: If no message with the given ID exists.
             AgentMemoryValidationError: If ``message_id`` is empty or tenant is missing
-                for ``SUBSCRIBER_ONLY``.
+                for ``SUBSCRIBER``.
             AgentMemoryHttpError: If the request fails.
         """
         _require_non_empty(message_id=message_id)
@@ -594,14 +599,14 @@ def list_messages(
             access_strategy: Tenant access strategy. Overrides the client default when
                 provided. Falls back to the default set on :func:`create_client`.
             tenant: Subscriber tenant subdomain. Overrides the client default when
-                provided. Required (at call or client level) when strategy is ``SUBSCRIBER_ONLY``.
+                provided. Required (at call or client level) when strategy is ``SUBSCRIBER``.
 
         Returns:
             List of :class:`Message` objects.
 
         Raises:
             AgentMemoryValidationError: If ``limit`` < 1, ``offset`` < 0, a filter
-                clause is invalid, or tenant is missing for ``SUBSCRIBER_ONLY``.
+                clause is invalid, or tenant is missing for ``SUBSCRIBER``.
             AgentMemoryHttpError: If the request fails.
         """
         if limit < 1:
@@ -643,13 +648,13 @@ def get_retention_config(
             access_strategy: Tenant access strategy. Overrides the client default when
                 provided. Falls back to the default set on :func:`create_client`.
             tenant: Subscriber tenant subdomain. Overrides the client default when
-                provided. Required (at call or client level) when strategy is ``SUBSCRIBER_ONLY``.
+                provided. Required (at call or client level) when strategy is ``SUBSCRIBER``.
 
         Returns:
             The current :class:`RetentionConfig`.
 
         Raises:
-            AgentMemoryValidationError: If tenant is missing for ``SUBSCRIBER_ONLY``.
+            AgentMemoryValidationError: If tenant is missing for ``SUBSCRIBER``.
             AgentMemoryHttpError: If the request fails.
         """
         tenant_subdomain = self._resolve_tenant(access_strategy, tenant)
@@ -679,11 +684,11 @@ def update_retention_config(
             access_strategy: Tenant access strategy. Overrides the client default when
                 provided. Falls back to the default set on :func:`create_client`.
             tenant: Subscriber tenant subdomain. Overrides the client default when
-                provided. Required (at call or client level) when strategy is ``SUBSCRIBER_ONLY``.
+                provided. Required (at call or client level) when strategy is ``SUBSCRIBER``.
 
         Raises:
             AgentMemoryValidationError: If no fields are provided, any provided value is
-                negative, or tenant is missing for ``SUBSCRIBER_ONLY``.
+                negative, or tenant is missing for ``SUBSCRIBER``.
             AgentMemoryHttpError: If the request fails.
         """
         if message_days is None and memory_days is None and usage_log_days is None:

src/sap_cloud_sdk/agent_memory/config.py

@@ -36,7 +36,7 @@ class AgentMemoryConfig:
         client_id: The OAuth2 client ID. Optional.
         client_secret: The OAuth2 client secret. Optional.
         identityzone: The provider tenant identity zone subdomain. Required when using
-                      ``SUBSCRIBER_ONLY`` access strategy so the subscriber token URL
+                      ``SUBSCRIBER`` access strategy so the subscriber token URL
                       can be derived by replacing this value in ``token_url``.
         timeout: Timeout in seconds for HTTP requests. Default is 30.0.