The company brain has a permissions problem
Every company is connecting Slack, email, docs and meetings into one brain that gives everyone access to everything the company knows.Nobody...
📝 摘要
本文探讨了企业级"公司大脑"（Company Brain）系统面临的权限模型问题。当 AI 系统将 Slack、邮件、文档和会议聚合为统一知识库时，传统的基于文件/对象的 ACL 权限模型不再适用——因为信息在综合、推断和传播过程中已脱离原始容器。文章提出了以"声明"（claim）为权限单元的新范式，每个持久化声明应携带来源归因、可见范围、用途限制、时效性、行动授权和人类介入条件等策略。
核心概念： 企业大脑的权限模型必须从"文件级访问控制"升级为"信息级策略传播"——权限随知识流动，而非绑定在源对象上。否则，一旦建立无差别的记忆系统，员工将自我审查，坦诚将不可逆地流失。
关键技术栈 / 关键要点：
- 源权限是底线而非全部 — 源 ACL 回答"谁能打开这个对象"，但综合后的问题更复杂：CEO 对董事会的谈话是否应被新销售代理知晓？
- 知识有时应传播得更远 — 销售从客户邮件中学到的教训应该传递给产品团队，但不应暴露整个收件箱；企业大脑可以提取教训、剥离敏感细节、保留溯源收据
- 知识有时应传播得更近 — 会议录音中随口玩笑、半成品观点不应成为永久组织记忆；选择性遗忘是好大脑的一部分
- Agent 轨迹是新型会议录像 — 编码 Agent 的交互过程包含决策理由、约束发现和修正历史，丢弃轨迹等于丢弃日益增长的机构知识
- 归因是权限的一部分 — 推断不等于引用；"Matt 说 X"与"系统从 Matt 的三份提案推断出 X"有本质区别，摘要会"洗白"权限，推断会"洗白"归因
- 权限有时钟 — 信息适合传播的受众随时间变化（如周五全员大会前仅筹备组知晓），系统应在真正模糊且后果不可逆时才打断人类
- 跨组织 Agent 交互 — 采购方 Agent 与供应商 Agent 对话、个人 Agent 跨公司记忆，单组织权限系统无法覆盖
关键结论 / 实践建议： 权限模型不是可以事后补丁的——运行一年无差别大脑的企业已写入不可撤回的记忆，且已教会员工在系统前自我审查。理解会复利，不信任也会复利。从第一天就做对权限模型的公司，才能拥有员工真正愿意在它面前说话的大脑。
Every company is connecting Slack, email, docs and meetings into one brain that gives everyone access to everything the company knows.
Nobody actually wants that.
You joke on the all-hands that the roadmap is held together with duct tape, and the room laughs. Eight months later a new hire asks the brain whether the roadmap is on track and gets your quote back, minus the laughter.
A customer tells your account exec in a private email that they almost churned over onboarding. The product team needs to know that, but nobody wants to hand them the whole inbox.
An agent reads three proposals Matt wrote and concludes he prefers a monolith. That might even be right, but it doesn't give the agent license to tell someone "Matt said we should use a monolith." He never did.
Today, the standard permission model is simple: if I can see a Slack message, my agent can see it. Mirror the sources, inherit their permissions, done. That works when software returns the source.
A company brain does something else. It extracts a decision from a meeting, combines it with an email, stores the result as memory, routes it to someone else and later gives it to an agent answering a customer. By then, the information has moved far beyond the object that originally contained it, and the permission model has to move with it.
The unit of permission is no longer the file. It's the claim: any piece of context the brain carries forward. "Acme needs SSO by September." "The migration will likely slip because the lead engineer is out." A claim might be something a person stated directly or something the brain assembled from five sources. Either way, it now lives outside any file, and the file's permissions no longer describe it.
Source permissions are the floor
Source permissions are still necessary. If someone cannot access a Slack channel or a Drive folder, their agent should not suddenly be able to browse it. The mistake is assuming the source ACL tells you everything you need to know after the information has been transformed.
A source permission answers one narrow question: who can open this object? A company brain has to answer harder ones. Should the new sales hire's agent know what the CEO told the board about the layoff timeline? Should a candid remark from a 1:1 become durable memory? Did the customer actually say they're churning, or did the brain infer it? Can an agent act on that inference?
Those questions appear because company brains do more than retrieve. They synthesize, and synthesis changes the permission problem.
Sometimes knowledge should travel farther than the source
A salesperson learns something important in a private email with a customer. The customer explains exactly why they bought and why they rejected a competitor. Six months later, the product team is debating the same issue.
The product team needs the lesson, not the inbox.
Today, those two things are coupled: either you can access the source or you cannot. A company brain can separate them. It can extract the lesson, strip out the sensitive details, preserve a receipt back to the evidence and route the lesson to the people who need it. The inbox stays private while the knowledge becomes organizational.
The same thing happens in engineering. Someone discovers an obscure workaround in a restricted channel, and another engineer hits the same bug three months later. The second engineer should benefit from what the first one learned without inheriting access to every conversation in that channel.
The company knows more than any individual employee can see. The brain should be able to move the useful part without exposing everything around it.
Sometimes knowledge should travel less far than the source
A meeting recording is shared with the whole company. The first five minutes are people catching up. Someone describes their weekend, someone jokes about a coworker, and someone vents about a decision they think is wrong. Then the meeting starts and the group makes an important product call.
Everyone may legitimately have access to the recording. That does not mean every sentence deserves to become permanent company memory.
Humans understand this naturally. We constantly say things that are appropriate for the people in the room and inappropriate as permanent organizational knowledge. You can tell six coworkers something personal without meaning for a new employee to retrieve it a year later, or float a half-formed opinion without wanting it treated as your settled view. A joke lands very differently once it has been detached from its tone and audience and surfaced by an agent months later.
The source ACL cannot express any of this. The brain has to understand what the content means. Some parts of the meeting should become durable memory, some should stay available only in the recording, and some should drop out of organizational memory entirely.
People already become more careful when a meeting recorder joins. Now imagine every conversation automatically distilled into permanent, searchable company memory. People will joke less, float fewer half-formed ideas, and stop bringing personal context into work conversations. The company will capture more words and understand less.
Selective forgetting is part of a good company brain. A brain that remembers everything eventually changes the behavior of the people it is trying to understand.
Agent traces are the new meeting recordings
Agents themselves are now a source of company context that barely existed a few years ago.
An engineer might spend three hours working with a coding agent. At the end, the company gets a pull request. But the PR is only the final artifact. Along the way, the agent inspected files, called tools, rejected approaches, discovered constraints, received corrections from the engineer and made decisions about how the code should work. Most of that context disappears.
We decided meetings were worth recording because the conversation leading to a decision contains useful information. The agent trace is the equivalent of the meeting recording. The final artifact tells you what changed. The trace tells you why. It may contain the reason one design was rejected, a constraint that is nowhere in the codebase, a customer requirement the engineer pasted into the conversation or a correction that will matter again next month.
As agents do more work, more of the company's reasoning will happen inside these interactions. Throwing the trace away means throwing away a growing share of institutional knowledge.
That does not mean storing every token forever. Raw traces contain noise, failed attempts, secrets and personal prompts. The useful object is the decision history: enough evidence to reconstruct what happened, plus the parts that deserve to become durable memory.
This creates a new ownership problem. If Jessica leaves the company, should everything her coding agent learned leave too?
Probably not; the agent may have learned why a migration failed, how a customer exception works and which design has already been rejected twice, and that knowledge belongs to the company. But the same agent may contain a conversation where Jessica prepared someone's performance review or talked through a conflict with a coworker, and that should not become shared institutional memory.
The system needs to separate the two while the context is created, because offboarding is too late.
Attribution is part of permissions
A company brain will also create information that nobody wrote down.
Suppose the system reads three proposals written by Matt and concludes that he prefers a particular architecture. That can be useful context. But the system should not say:
Matt said we should use this architecture
Matt never said that; the brain inferred it.
The distinction matters because "Matt said X" carries more weight than "the system inferred X from Matt's work." The first statement needs a receipt: an email, transcript or document span where Matt actually said it. Otherwise the system has to speak in its own voice:
Inferred from three proposals Matt wrote
Every important claim needs provenance. Where did it come from? Was it stated, inferred or unknown? How current is it? How confident should the system be?
And that history has to survive transformation. A private email does not become unrestricted because an agent summarized it. An inference does not become a quote because it was repeated three times. A trustworthy company brain has to preserve the chain.
Summaries launder permissions. Inferences launder attribution.
Permissions have a clock
Even if the system knows who should know something today, the answer can change tomorrow.
A team decides to launch a new employee benefit. The people preparing the launch should know immediately. Customers should not know. The rest of the company might find out at the all-hands on Friday. After the announcement, the information can flow into recruiting, sales and marketing.
Nothing about the underlying fact changed, but its appropriate audience did.
This kind of intent is rarely encoded anywhere. Someone thinks "I want to announce this myself" and never sets an embargo flag. A customer is happy for their story to help a salesperson and uncomfortable seeing it turned into a LinkedIn post. A founder discusses an upcoming product casually without ever saying the word "embargoed."
Humans carry a lot of permission policy in their heads. Sometimes the system has to ask:
You just made a major product decision. Should I share this with the company?
The hard part is knowing when to interrupt. A system that asks for permission every five minutes trains people to ignore it. Human judgment should be reserved for cases where the answer is genuinely ambiguous and the consequences are difficult to undo. Sharing an internal observation with one additional teammate is reversible. Publishing something externally, sending a customer email or taking an irreversible action deserves a much higher bar.
The system should resolve routine cases automatically, leave a receipt and save human attention for the few decisions where judgment matters.
One company is the easy case
Most permission systems assume one organization with one administrator. Agents will break that assumption.
A buyer's agent will talk to a vendor's agent. A company agent will work with an employee's personal agent. A support agent will turn internal knowledge into an external answer. Eventually, company brains will exchange context directly with other company brains, and there is no single permission system controlling both sides.
And "internal" versus "external" is too simple. A signed contract from a customer may be more authoritative than an internal CRM field. A claim inferred by another company's agent may be useful for research and nowhere near trustworthy enough to trigger an irreversible action.
Context needs to carry its authority with it. A piece of information might be safe to read, safe to use in a recommendation and unsafe to use as the sole basis for an action. That difference becomes critical once agents can do more than answer questions.
Person-owned agents make the boundary even harder. Their memory may span jobs. The person should keep their private history, and the employer should keep the work knowledge the company paid to create. Confidential company context cannot bleed into the next company, personal context cannot be absorbed into the old one, and the boundary has to exist inside the memory itself.
The permission model travels with the knowledge
These dimensions are independent. A company can have strict source boundaries and heavy content filtering. Another can let useful knowledge move aggressively across teams while keeping very little raw conversation. Agent-created context is another source. Human judgment is an escalation mechanism. Attribution, timing, audience and action authority cut across all of them. The common primitive is the claim.
Every durable claim in a company brain should carry its own policy. At minimum, the brain needs to know:
- where the claim came from and whether it was stated or inferred
- who can receive it
- what it can be used for
- how long it should remain in memory
- when its audience can change
- what actions an agent can take based on it
- when a human needs to decide
The source permission is the starting point. Then the policy travels with the context as it is summarized, combined, remembered and shared. Traditional permissions govern objects, while a company brain has to govern information as it moves.
This is not a problem you can retrofit. A company that runs an indiscriminate brain for a year has written a year of unretractable memory: the jokes, the venting, the half-formed opinions, the inferences presented as quotes. Worse, it has spent a year teaching its people what the brain does with what they say. Once employees learn that everything becomes permanent and searchable, they talk differently, and the candor does not come back when you fix the permission model later.
Understanding compounds, and so does distrust. The companies that get the permission model right from the start will have brains their people actually talk in front of.
Permissions are part of the intelligence
At Hyperspell, we are building a company brain: a continuously updated model of what a company knows across its messages, documents, meetings, systems and agents.
Connectors are the sensor layer. The harder work starts once all of that context begins interacting. The brain has to decide which sources to trust, what deserves to become memory, where a conclusion came from, who should receive it and what an agent is allowed to do with it.
Useful knowledge should reach the people and agents who need it without exposing everything around it. Casual conversations should be allowed to stay casual, an inference should remain an inference, and company knowledge should survive employee turnover without absorbing everything personal around it. Sometimes the brain should know enough to ask before it speaks.
This is one of the core problems we are solving at Hyperspell. If you want to see what a company brain with a real permission model looks like, we can show you in fifteen minutes.
A useful company brain knows what the company knows.
A trustworthy one also knows when to keep quiet.