Your company brain will leak secrets: how we stopped it for big banks — Tanmai Gopal, PromptQL
Shared agent memory needs user-scoped reads, human-approved writes, and per-request credentials. The talk offers a concrete security boundary for company-wide context and tools.
The proposed design keeps knowledge in **one company-wide wiki**, scopes each page by access claims, and requires every accepted change to carry a human's name. Agents suggest edits; a person verifies the facts and chooses their visibility.
For coding agents, apply the requesting user's claims on every context read and every tool execution. Keep credentials out of cloud sandboxes, then inject **user credentials at the HTTP or SQL layer** so an agent cannot inherit broader ambient authority.
The proposed design keeps knowledge in **one company-wide wiki**, scopes each page by access claims, and requires every accepted change to carry a human's name. Agents suggest edits; a person verifies the facts and chooses their visibility. For coding agents, apply the requesting user's claims on every context read and every tool execution. Keep credentials out of cloud sandboxes, then inject **user credentials at the HTTP or SQL layer** so an agent cannot inherit broader ambient authority. The speaker reports work with only **about 15–20 organizations**, and the shared multi-user deployment case receives limited detail. The principles are concrete, but implementation nuances and evidence of resistance to adversarial failures remain open.
This turns shared enterprise context into an authorization and provenance system: every read and action inherits the requesting user’s claims, while humans own factual acceptance and visibility. It complements credential controls by addressing what agents may see and change, but leaves adversarial robustness and multi-user implementation evidence notably thin.