Your company brain will leak secrets: how we stopped it for big banks — Tanmai Gopal, PromptQL
Shared agent memory needs user-scoped reads, human-approved writes, and per-request credentials. The talk offers a concrete security boundary for company-wide context and tools.
The proposed design keeps knowledge in **one company-wide wiki**, scopes each page by access claims, and requires every accepted change to carry a human's name. Agents suggest edits; a person verifies the facts and chooses their visibility.
For coding agents, apply the requesting user's claims on every context read and every tool execution. Keep credentials out of cloud sandboxes, then inject **user credentials at the HTTP or SQL layer** so an agent cannot inherit broader ambient authority.
The proposed design keeps knowledge in **one company-wide wiki**, scopes each page by access claims, and requires every accepted change to carry a human's name. Agents suggest edits; a person verifies the facts and chooses their visibility. For coding agents, apply the requesting user's claims on every context read and every tool execution. Keep credentials out of cloud sandboxes, then inject **user credentials at the HTTP or SQL layer** so an agent cannot inherit broader ambient authority. The speaker reports work with only **about 15–20 organizations**, and the shared multi-user deployment case receives limited detail. The principles are concrete, but implementation nuances and evidence of resistance to adversarial failures remain open.
This makes enterprise context security an identity-and-data-path problem: shared knowledge remains useful only when every read, edit, and action carries user-level claims and attribution. It confirms human ownership of risky knowledge changes and rejects ambient agent authority, but the small deployment base and limited adversarial evidence leave multi-user enforcement unresolved.