# Your company brain will leak secrets: how we stopped it for big banks — Tanmai Gopal, PromptQL

Source: [AI Engineer](https://www.youtube.com/watch?v=0uC6u0lJJl4)  
Feed7 permalink: https://feed7.dev/p/your-company-brain-will-leak-secrets-how-we-stopped-it-for-big-banks-tan-1xrm58g  
Published: 2026-09-03T15:30:26.000Z  
Trust: Source Linked (source_linked)

## Why Included

Shared agent memory needs user-scoped reads, human-approved writes, and per-request credentials. The talk offers a concrete security boundary for company-wide context and tools.

## Source Summary

The proposed design keeps knowledge in **one company-wide wiki**, scopes each page by access claims, and requires every accepted change to carry a human's name. Agents suggest edits; a person verifies the facts and chooses their visibility.

## Practical Implication

For coding agents, apply the requesting user's claims on every context read and every tool execution. Keep credentials out of cloud sandboxes, then inject **user credentials at the HTTP or SQL layer** so an agent cannot inherit broader ambient authority.

## Agent-Ready Context

The proposed design keeps knowledge in **one company-wide wiki**, scopes each page by access claims, and requires every accepted change to carry a human's name. Agents suggest edits; a person verifies the facts and chooses their visibility.

For coding agents, apply the requesting user's claims on every context read and every tool execution. Keep credentials out of cloud sandboxes, then inject **user credentials at the HTTP or SQL layer** so an agent cannot inherit broader ambient authority.

The speaker reports work with only **about 15–20 organizations**, and the shared multi-user deployment case receives limited detail. The principles are concrete, but implementation nuances and evidence of resistance to adversarial failures remain open.

## Connected Context

Feed7 judgment across 693 accumulated Signals:

This makes enterprise context security an identity-and-data-path problem: shared knowledge remains useful only when every read, edit, and action carries user-level claims and attribution. It confirms human ownership of risky knowledge changes and rejects ambient agent authority, but the small deployment base and limited adversarial evidence leave multi-user enforcement unresolved.

- [The end of credential sprawl for agents](https://feed7.dev/p/the-end-of-credential-sprawl-for-agents-0iwzpki) — Vercel Connect supplies a complementary credential lifecycle for the same least-authority goal through short-lived, per-user credentials, revocation, and auditability.
- [AI in GTM at Notion — Flora Liu](https://feed7.dev/p/ai-in-gtm-at-notion-flora-liu-0y24r7m) — Notion reinforces shared, attributable context and human approval for risky actions, though in a GTM workflow rather than access-controlled banking environments.

## Context Map

- Layer: context
- Domains: security, coding
- Topics: context-engineering, tool-use, enterprise

## Uncertainty

- The speaker reports work with only **about 15–20 organizations**, and the shared multi-user deployment case receives limited detail. The principles are concrete, but implementation nuances and evidence of resistance to adversarial failures remain open.

## Agent Instruction

Use this item as source-backed context. Do not invent claims beyond the linked source. If this item conflicts with another source, call out the conflict.