Every company is connecting Slack, email, docs and meetings into one brain that gives everyone access to everything the company knows.
Nobody actually wants that.
You joke on the all-hands that the roadmap is held together with duct tape, and the room laughs. Eight months later a new hire asks the brain whether the roadmap is on track and gets your quote back, minus the laughter.
A customer tells your account exec in a private email that they almost churned over onboarding. The product team needs to know that, but nobody wants to hand them the whole inbox.
An agent reads three proposals Matt wrote and concludes he prefers a monolith. That might even be right, but it doesn't give the agent license to tell someone "Matt said we should use a monolith." He never did.
Today, the standard permission model is simple: if I can see a Slack message, my agent can see it. Mirror the sources, inherit their permissions, done. That works when software returns the source.
A company brain does something else. It extracts a decision from a meeting, combines it with an email, stores the result as memory, routes it to someone else and later gives it to an agent answering a customer. By then, the information has moved far beyond the object that originally contained it, and the permission model has to move with it.
The unit of permission is no longer the file. It's the claim: any piece of context the brain carries forward. "Acme needs SSO by September." "The migration will likely slip because the lead engineer is out." A claim might be something a person stated directly or something the brain assembled from five sources. Either way, it now lives outside any file, and the file's permissions no longer describe it.
Source permissions are the floor
Source permissions are still necessary. If someone cannot access a Slack channel or a Drive folder, their agent should not suddenly be able to browse it. The mistake is assuming the source ACL tells you everything you need to know after the information has been transformed.
A source permission answers one narrow question: who can open this object? A company brain has to answer harder ones. Should the new sales hire's agent know what the CEO told the board about the layoff timeline? Should a candid remark from a 1:1 become durable memory? Did the customer actually say they're churning, or did the brain infer it? Can an agent act on that inference?
Those questions appear because company brains do more than retrieve. They synthesize, and synthesis changes the permission problem.
Sometimes knowledge should travel farther than the source
A salesperson learns something important in a private email with a customer. The customer explains exactly why they bought and why they rejected a competitor. Six months later, the product team is debating the same issue.
The product team needs the lesson, not the inbox.
Today, those two things are coupled: either you can access the source or you cannot. A company brain can separate them. It can extract the lesson, strip out the sensitive details, preserve a receipt back to the evidence and route the lesson to the people who need it. The inbox stays private while the knowledge becomes organizational.
The same thing happens in engineering. Someone discovers an obscure workaround in a restricted channel, and another engineer hits the same bug three months later. The second engineer should benefit from what the first one learned without inheriting access to every conversation in that channel.
The company knows more than any individual employee can see. The brain should be able to move the useful part without exposing everything around it.
Sometimes knowledge should travel less far than the source
A meeting recording is shared with the whole company. The first five minutes are people catching up. Someone describes their weekend, someone jokes about a coworker, and someone vents about a decision they think is wrong. Then the meeting starts and the group makes an important product call.
Everyone may legitimately have access to the recording. That does not mean every sentence deserves to become permanent company memory.
Humans understand this naturally. We constantly say things that are appropriate for the people in the room and inappropriate as permanent organizational knowledge. You can tell six coworkers something personal without meaning for a new employee to retrieve it a year later, or float a half-formed opinion without wanting it treated as your settled view. A joke lands very differently once it has been detached from its tone and audience and surfaced by an agent months later.
The source ACL cannot express any of this. The brain has to understand what the content means. Some parts of the meeting should become durable memory, some should stay available only in the recording, and some should drop out of organizational memory entirely.
People already become more careful when a meeting recorder joins. Now imagine every conversation automatically distilled into permanent, searchable company memory. People will joke less, float fewer half-formed ideas, and stop bringing personal context into work conversations. The company will capture more words and understand less.
Selective forgetting is part of a good company brain. A brain that remembers everything eventually changes the behavior of the people it is trying to understand.
Agent traces are the new meeting recordings
Agents themselves are now a source of company context that barely existed a few years ago.
An engineer might spend three hours working with a coding agent. At the end, the company gets a pull request. But the PR is only the final artifact. Along the way, the agent inspected files, called tools, rejected approaches, discovered constraints, received corrections from the engineer and made decisions about how the code should work. Most of that context disappears.
We decided meetings were worth recording because the conversation leading to a decision contains useful information. The agent trace is the equivalent of the meeting recording. The final artifact tells you what changed. The trace tells you why. It may contain the reason one design was rejected, a constraint that is nowhere in the codebase, a customer requirement the engineer pasted into the conversation or a correction that will matter again next month.
As agents do more work, more of the company's reasoning will happen inside these interactions. Throwing the trace away means throwing away a growing share of institutional knowledge.
That does not mean storing every token forever. Raw traces contain noise, failed attempts, secrets and personal prompts. The useful object is the decision history: enough evidence to reconstruct what happened, plus the parts that deserve to become durable memory.
This creates a new ownership problem. If Jessica leaves the company, should everything her coding agent learned leave too?
Probably not; the agent may have learned why a migration failed, how a customer exception works and which design has already been rejected twice, and that knowledge belongs to the company. But the same agent may contain a conversation where Jessica prepared someone's performance review or talked through a conflict with a coworker, and that should not become shared institutional memory.
The system needs to separate the two while the context is created, because offboarding is too late.
Attribution is part of permissions
A company brain will also create information that nobody wrote down.
Suppose the system reads three proposals written by Matt and concludes that he prefers a particular architecture. That can be useful context. But the system should not say:
Matt said we should use this architecture
Matt never said that; the brain inferred it.
The distinction matters because "Matt said X" carries more weight than "the system inferred X from Matt's work." The first statement needs a receipt: an email, transcript or document span where Matt actually said it. Otherwise the system has to speak in its own voice:
Inferred from three proposals Matt wrote
Every important claim needs provenance. Where did it come from? Was it stated, inferred or unknown? How current is it? How confident should the system be?
And that history has to survive transformation. A private email does not become unrestricted because an agent summarized it. An inference does not become a quote because it was repeated three times. A trustworthy company brain has to preserve the chain.
Summaries launder permissions. Inferences launder attribution.
Permissions have a clock
Even if the system knows who should know something today, the answer can change tomorrow.
A team decides to launch a new employee benefit. The people preparing the launch should know immediately. Customers should not know. The rest of the company might find out at the all-hands on Friday. After the announcement, the information can flow into recruiting, sales and marketing.
Nothing about the underlying fact changed, but its appropriate audience did.
This kind of intent is rarely encoded anywhere. Someone thinks "I want to announce this myself" and never sets an embargo flag. A customer is happy for their story to help a salesperson and uncomfortable seeing it turned into a LinkedIn post. A founder discusses an upcoming product casually without ever saying the word "embargoed."
Humans carry a lot of permission policy in their heads. Sometimes the system has to ask:
You just made a major product decision. Should I share this with the company?
The hard part is knowing when to interrupt. A system that asks for permission every five minutes trains people to ignore it. Human judgment should be reserved for cases where the answer is genuinely ambiguous and the consequences are difficult to undo. Sharing an internal observation with one additional teammate is reversible. Publishing something externally, sending a customer email or taking an irreversible action deserves a much higher bar.
The system should resolve routine cases automatically, leave a receipt and save human attention for the few decisions where judgment matters.
One company is the easy case
Most permission systems assume one organization with one administrator. Agents will break that assumption.
A buyer's agent will talk to a vendor's agent. A company agent will work with an employee's personal agent. A support agent will turn internal knowledge into an external answer. Eventually, company brains will exchange context directly with other company brains, and there is no single permission system controlling both sides.
And "internal" versus "external" is too simple. A signed contract from a customer may be more authoritative than an internal CRM field. A claim inferred by another company's agent may be useful for research and nowhere near trustworthy enough to trigger an irreversible action.
Context needs to carry its authority with it. A piece of information might be safe to read, safe to use in a recommendation and unsafe to use as the sole basis for an action. That difference becomes critical once agents can do more than answer questions.
Person-owned agents make the boundary even harder. Their memory may span jobs. The person should keep their private history, and the employer should keep the work knowledge the company paid to create. Confidential company context cannot bleed into the next company, personal context cannot be absorbed into the old one, and the boundary has to exist inside the memory itself.
The permission model travels with the knowledge
These dimensions are independent. A company can have strict source boundaries and heavy content filtering. Another can let useful knowledge move aggressively across teams while keeping very little raw conversation. Agent-created context is another source. Human judgment is an escalation mechanism. Attribution, timing, audience and action authority cut across all of them. The common primitive is the claim.
Every durable claim in a company brain should carry its own policy. At minimum, the brain needs to know:
- where the claim came from and whether it was stated or inferred
- who can receive it
- what it can be used for
- how long it should remain in memory
- when its audience can change
- what actions an agent can take based on it
- when a human needs to decide
The source permission is the starting point. Then the policy travels with the context as it is summarized, combined, remembered and shared. Traditional permissions govern objects, while a company brain has to govern information as it moves.
This is not a problem you can retrofit. A company that runs an indiscriminate brain for a year has written a year of unretractable memory: the jokes, the venting, the half-formed opinions, the inferences presented as quotes. Worse, it has spent a year teaching its people what the brain does with what they say. Once employees learn that everything becomes permanent and searchable, they talk differently, and the candor does not come back when you fix the permission model later.
Understanding compounds, and so does distrust. The companies that get the permission model right from the start will have brains their people actually talk in front of.
Permissions are part of the intelligence
At Hyperspell, we are building a company brain: a continuously updated model of what a company knows across its messages, documents, meetings, systems and agents.
Connectors are the sensor layer. The harder work starts once all of that context begins interacting. The brain has to decide which sources to trust, what deserves to become memory, where a conclusion came from, who should receive it and what an agent is allowed to do with it.
Useful knowledge should reach the people and agents who need it without exposing everything around it. Casual conversations should be allowed to stay casual, an inference should remain an inference, and company knowledge should survive employee turnover without absorbing everything personal around it. Sometimes the brain should know enough to ask before it speaks.
This is one of the core problems we are solving at Hyperspell. If you want to see what a company brain with a real permission model looks like, we can show you in fifteen minutes.
A useful company brain knows what the company knows.
A trustworthy one also knows when to keep quiet.
