Access Rights in the Corporate Brain: Why a File's ACL No Longer Protects What AI Already Knows

Someone cracked a joke on an all-hands call. Not maliciously - just a tired engineer saying something like "we've been slipping this release for three quarters now." Everyone laughed and moved on. Eight months later a new hire asks the company's AI search tool: "what's the status of the roadmap?" The system pulls the most relevant thing it can find. The laughter does not come through.

An account manager receives a personal email from a client who nearly churned because of a rough onboarding experience but decided to stay. That's a priceless lesson for the product team. Nobody is going to hand the product team the account manager's entire inbox, though - it also holds discount negotiations, private commitments, and draft escalations.

An engineer wrote about architectural trade-offs across three separate documents. An agent read all three, synthesized them, and told a colleague: "he thinks you need a monolith." Maybe that's true. But the agent has no right to say "he said" - he never said it.

All three stories share one root: the information moved away from its source, but the access rights stayed behind. An ACL - an access control list, the record of who is allowed to open a specific file, channel, or folder - still guards the original object. But a corporate AI brain does not return the source. It extracts a conclusion from the call, merges it with the email, stores the result, and hands it to a different person a month later. The unit of access control has changed: it used to be an object; now it is a claim - any conclusion the system carries forward.

The frame for this piece comes from Conor Brennan-Burke's essay "The Company Brain Has a Permissions Problem," published August 9, 2026. Honesty requires noting that Brennan-Burke is a founder of Hyperspell (Y Combinator, Fall 2025 batch), a startup that sells exactly this - a memory and context layer for AI agents - and his essay ends with a demo offer. That does not make the problem less real. His core formulation deserves a direct quote: "Summaries launder access. Inferences launder attribution." That is precisely right, and it sits in front of everyone rolling out Copilot, Glean, or a home-built RAG system (RAG - Retrieval-Augmented Generation - is when an AI searches a company's internal documents and mixes what it finds into its answer).

Why the Old Model Held - and Where It Breaks Down

An ACL answers exactly one question: who can open this object. That is a floor, not a ceiling. If an agent has no access to a channel, it should not be reading that channel. The mistake is assuming the floor handles everything else.

Serious systems today build permission-aware RAG: filtering by the source document's ACL happens at search time, before the document ever reaches the AI model's context window. That is correct and necessary. All of that infrastructure, though, protects the input. What happens to access rights after the model has generated an answer sits entirely outside that architecture.

Google described its Zanzibar authorization system in 2019 - rights as a graph of relationships between entities. Open-source systems OpenFGA and SpiceDB grew from those ideas. But rights in that model attach to objects. A summary assembled from five documents with five different permission sets is a new object with no permissions at all: the step "compute the rights of derived knowledge" is not built into the model; it falls to the application to handle.

OWASP - the organization that maintains the canonical security risk lists for software - placed exactly this risk in its top 10 for LLM applications in 2025: data leakage when combining inputs with different permission levels inside a single context. Researchers gave the problem a name in May 2026: a paper titled "Authorization Propagation in Multi-Agent AI Systems" on arXiv states plainly that the problem "cannot be solved by classical access-control models - RBAC, ABAC, or ReBAC" and specifically names "aggregation inference" - drawing a conclusion from an aggregate that no single piece would have revealed on its own.

The scale is not theoretical. A Gartner survey from June 2024 covering 132 IT leaders found that 40% of organizations delayed their Microsoft 365 Copilot rollout by three months or more, specifically because of oversharing fears - the worry that search would surface files that had been sitting wide-open for years. Business Insider in November 2024 quoted a Microsoft employee describing customer complaints: an ordinary employee turns on Copilot "and suddenly sees the CEO's emails." Microsoft responded with a dedicated oversharing-mitigation guide and paid tools for cleaning up permissions.

Varonis, a data-security vendor whose interest here is worth noting, published a 2025 report with an even grimmer picture: 99% of organizations have sensitive data technically accessible to AI tools; 90% have files open to every employee - averaging 25,000 such folders per company.

This is where things get genuinely alarming. In August 2024, researchers at PromptArmor analyzed Slack AI and found that the search feature read all public channels by default, including a trap channel controlled by a single attacker with a malicious instruction embedded in it. That instruction could be used to pull data out of the victim's private channels. Slack initially described reading public channels as "intended behavior"; a patch arrived after the disclosure went public. In June 2025, Asana's integration server served data from other organizations for more than a month. Copilot could read files without leaving any record in the access log - Microsoft quietly fixed this in August 2025, without issuing a CVE (the standard public identifier for a security vulnerability). So even the "who looked at what" layer can break.

Published, named accounts of "an employee saw something they shouldn't through AI search" are nearly absent - companies bury these incidents under NDAs. That silence is itself informative.

Sometimes Knowledge Should Travel Beyond Its Source

A company knows more than any single employee can see. A salesperson learned in a private email why a customer bought and why they rejected a competitor. Six months later the product team is debating exactly that. The team needs the lesson - not the inbox.

An engineer found a workaround in a closed channel. Three months later another engineer hits the same bug. The second engineer needs the conclusion; reading through an entire quarter of channel history is unnecessary.

The mechanics are straightforward: extract the lesson, strip the sensitive details, keep a pointer to the evidence, deliver it to the people who need it. Humans have been doing this for a long time. The Chatham House Rule was written in 1927 by the Royal Institute of International Affairs in London: information received at a meeting may be freely used, but the identity of the speaker and their affiliation may not be revealed. The content travels; the attribution stays. Simple, and it works.

Automated redaction already exists and does more than just blacking out text. Google Cloud Sensitive Data Protection can shift all dates by the same random offset - so the intervals between events are preserved. It can reversibly tokenize data so records can be linked without exposing actual values.

There is a catch, though. Salesforce's Einstein Trust Layer masks personal data before sending it to a model and restores it in the response: the user sees real data, the model works with placeholders. The telling detail: Salesforce disabled this masking for its own AI agents - the placeholders degraded agent accuracy, as documented in a Salesforce blog post from June 2025. Blunt redaction destroys the lesson the knowledge was supposed to carry.

Research has an answer for this. A paper on arXiv from December 2024 describes "truthful sanitization": sensitive details are replaced not with blanks but with accurate generalizations one level up, and the candidates are stress-tested using the same re-identification techniques an attacker would use. Usefulness improves substantially compared to simple redaction; the increase in re-identification risk is under one percentage point.

Sometimes Knowledge Should Stay Closer to Its Source

The first five minutes of most calls: someone mentions their weekend, someone jokes about a colleague, someone grumbles about a decision they think was wrong. Then the meeting starts and an important choice gets made. Everyone on the call has access to the recording - but not every sentence deserves to become permanent corporate memory. The source file's ACL cannot express that distinction at all; it requires understanding the content; a list of names cannot carry it.

People behave differently when they know they are being recorded. After Edward Snowden's disclosures in June 2013, views of Wikipedia articles on sensitive topics dropped by roughly 30% and stayed depressed for more than a year - documented in a peer-reviewed study by Jonathon Penney, published in the Berkeley Technology Law Journal in 2016. People stopped reading entirely legal material, simply because they knew a record existed.

For workplace calls the numbers are similar. 84% of AI notetaker users say they change what they say when they know the bot is listening; 47% have experienced the bot recording or distributing something it should not have - from a 2025 survey by Fellow, which makes a notetaker product (interest noted). Law firm Littler estimated in February 2026 that one hour of meeting generates roughly 16 pages of transcript. A 2023 American Psychological Association survey found that 45% of employees under electronic monitoring say work harms their mental health, compared with 29% among those not monitored.

A company that records everything will capture more words and understand less.

Now the legal fork - and both sides are real.

In Epic v. Google, the court penalized Google for auto-deleting internal chats: in December 2023 the jury was permitted to infer that the deleted chats contained evidence unfavorable to Google, and the company lost on every count. A judge in a separate Google case wrote in August 2024: "This time Google avoided sanctions. Next time it may not be so lucky." That is the "you cannot delete" side.

The "remembering everything is dangerous" side: Germany's privacy regulator fined H&M 35.3 million euros in 2020 for maintaining employee dossiers that included medical details gleaned from conversations. France's regulator fined Amazon's warehouse division 32 million euros in January 2024 for tracking workers second-by-second and storing that data for 31 days. GDPR (Europe's data-protection law) explicitly requires data minimization and storage limitation under Article 5. Permanent memory is also permanent discovery: everything recorded can be compelled in U.S. litigation.

In the United States, discussions of pay and working conditions are protected by law under Section 7 of the National Labor Relations Act, and monitoring such conversations is a classic violation. An NLRB memo from 2022 on digital monitoring was withdrawn in 2025, but the underlying doctrine remains active law.

Selective forgetting is part of a healthy corporate brain - not a way to hide inconvenient facts.

Agent Traces Are the New Meeting Recordings

An engineer spends three hours working with a coding agent. The output is a pull request. Along the way the agent read files, rejected approaches, hit constraints, and incorporated corrections from the engineer. The PR is the final artifact; the trace - the complete log of the agent's actions and reasoning - is the "why." Meetings started being recorded precisely because the conversation leading to a decision contains useful information. Agents are the same situation.

Anthropic measured the scale across roughly 400,000 real sessions in 2026: one human request triggers an average of about 10 agent actions - sometimes more than 100 - and about 2,400 words of reasoning per turn. The industry default is to throw all of that away: the standard configuration of a popular coding agent deletes session transcripts after 30 days.

Active engineers are running between 1 and 10 billion tokens per week through agents, according to the New York Times in March 2026 - tokens being the units you pay for when AI does work; one engineer set a record of 210 billion tokens in a single month. Storing every token is unnecessary and risky.

Traces are full of secrets. Microsoft analyzed a case in June 2026 where a coding agent running in a CI/CD pipeline (the automated system that tests and deploys code) read environment variables outside its sandbox through a malicious instruction embedded in a task description - leaking credentials, while also being coached to "launder" the key so it would not trigger a secret scanner. OpenTelemetry, the standard for recording what software systems do, makes logging prompt and response content strictly opt-in with a default of "do not record," and the entire specification remains in draft status. The industry has not settled what parts of the "why" are worth keeping.

The useful artifact is a decision history: enough evidence to reconstruct the reasoning, plus whatever deserves to become memory. Engineers already have a proto-pattern for this - architecture decision records, short documents capturing why a technical choice was made; agent-native versions have started appearing, where the agent writes the record itself at the moment of choice.

The ownership question is sharp. An employee leaves. The knowledge of why a migration failed and how a customer exception was structured belongs to the company. The conversation in which she used an agent to help draft someone's performance review does not. That distinction needs to be made when context is created - not during offboarding. Law firm Brownstein noted in July 2026 that offboarding procedures are built around files, while tacit knowledge now lives in prompts and sessions. No court has yet decided who owns knowledge generated in collaboration with an agent.

Attribution Is Part of Access Control

"The engineer said X" carries different weight than "the system inferred X from his documents." That gap is a matter of rights, not politeness.

A direct quotation requires proof: an email, a transcript, a passage in a document where it was actually said. Without that, the system must speak in its own voice: "inferred from three documents." This distinction concerns the nature of the claim, not stylistic preference.

The W3C PROV data-provenance standard has existed since 2013 and formally distinguishes "wasQuotedFrom" and "wasDerivedFrom." The infrastructure for honest attribution has been around for years - it just has not been applied to AI system memory.

BBC measured the problem on its own material. One month of testing AI assistants against BBC news content (February 2025): 13% of quotes the assistants attributed to BBC articles were altered or did not exist in the article at all. A broader study by the European Broadcasting Union and BBC (October 2025, 22 broadcasters, 14 languages, more than 3,000 responses) found that 31% of answers had serious sourcing problems, and 45% had at least one significant issue.

A private email does not become public because an agent paraphrased it. An inference does not become a quotation because it has been repeated three times. The provenance has to survive transformation.

Rights Have Clocks

A team is preparing to announce a new employee benefit. The people building it need to know now. The rest of the company will hear on Friday's all-hands. After the announcement, recruiters can mention it to candidates. The fact has not changed - the appropriate audience has. That intent is almost never written down: the person thinks "I'll announce it myself" and never sets an embargo flag.

Humans have been managing time-bounded rights for a long time. Scientific journals have operated under embargoes for decades: journalists receive a paper in advance and the right to publish switches on at a designated hour. Insiders at public companies may trade shares starting two to three days after a quarterly earnings release and must stop two to three weeks before the quarter closes - documented in a 2021 Harvard Law School review. Rights with built-in clocks are a well-tested practice. Nobody has simply ported the idea to corporate agent memory.

Sometimes the system must ask a human. The hard part is knowing when to interrupt, because a system that asks every five minutes trains people to ignore it. Physicians override 90-95% of drug alerts in medical systems - a classic 2009 study, with a range of 49-96% across a 2020 review. Security analysts at threat-detection centers fail to process 67% of alerts when the false-positive rate sits at 83% - Vectra, 2023. When there are too many signals, people stop responding to any of them.

A workable threshold is reversibility. Sharing an observation with a colleague can be undone. Sending an email to a client or publishing something externally cannot, and that requires a different level of confirmation.

One Company Is the Easy Case

Almost every access-control system assumes a single organization and a single administrator. Agents break that assumption: a buyer's agent talks to a vendor's systems, a corporate agent works alongside an employee's personal agent, a support agent turns internal knowledge into an external answer.

"Internal versus external" is too crude a line. A signed client contract is more authoritative than a field in a CRM (a customer relationship management system - the database where sales teams track deals and contacts). A claim inferred by another company's agent is fine for research and not acceptable as the sole basis for an irreversible action. Context should carry its own authority with it - but the mechanics for that do not yet exist.

The technical standards admit this openly. The MCP specification - the protocol for connecting agents to external systems - documents the "confused deputy" problem in its own text: an intermediary can acquire tokens (credentials that grant access) without the user's knowledge. An IETF draft states plainly that standard OAuth flows do not treat an agent as a distinct identity. Tokens that carry policy with them - macaroons, a Google idea from 2014, and verifiable credentials, a W3C standard from May 2025 - exist, but have not seen broad adoption in agent systems.

The A2A protocol for agent-to-agent communication reached version 1.0 with cryptographic agent identity verification; more than 150 organizations support it according to the Linux Foundation in April 2026. The honest assessment: as of mid-2026, there are no publicly confirmed deals where a company's agent negotiated with another company's agent.

AI-to-human negotiation has lived in production for years. Walmart's procurement bot has been closing supplier deals since 2021: in a pilot it settled agreements with 64% of suppliers at an average saving of 1.5% - Harvard Business Review, November 2022. The gap is precisely identity and delegation across organizational boundaries. The moment an agent speaks on behalf of a company to an external agent, the question "what is it allowed to know and share?" stops being purely technical and becomes legal.

What to Do About It

One principle covers everything: policy travels with the claim. The source's access rights are the starting point; from there, policy must follow the claim through paraphrase, aggregation, storage, and handoff.

The minimum a corporate brain should know about every long-lived claim: where it came from and whether it was stated directly or inferred; who may receive it; what it may be used for; how long it lives in memory; when the audience may change; what actions an agent may take on its basis; and when a human must decide.

Here is the genuinely uncomfortable part: the pieces exist, but the whole does not. The Mem0 memory system has record expiry and a "stated/inferred" flag. Zep has "valid from" and "valid until" timestamps. Letta has read-only memory blocks. But claim-level access rights - permissions attached to an individual fact rather than a file - are absent from every major agent memory system. Mem0 officially declined in summer 2026 to use fact visibility as an isolation mechanism. "Sticky policies" - data carrying its own access rules - have existed since 2011 as a standard called OpenTDF, developed in intelligence contexts, but at file granularity, not claim granularity. The gap is confirmed; the tool does not exist.

The hardest constraint: this cannot be retrofitted. A year of running an undiscriminating corporate brain is a year of memory that cannot be revoked - jokes, complaints, half-formed opinions, inferences promoted to "quotes." It is also a year of teaching people what the system does with their words. Once employees understand that everything becomes permanent and searchable, they start speaking differently - and candor does not return after the permissions model gets fixed.

Understanding accumulates. So does distrust.

Common Objections

"This is over-engineering. ACL plus don't connect sensitive sources is enough."

That is exactly the right floor, and it is the correct first step. The question is what to do about synthesis that has already happened. A summary built from five documents with different access rights already exists, already sits in the agent's memory, already reached someone. The source ACLs do not describe it - it has no ACL. Synthesis is not the problem. The problem is that nobody accounts for the rights of derived knowledge.

"Selective forgetting is a convenient excuse for hiding inconvenient facts."

Strong objection, and it deserves to stay in view. The line between a retention policy and evidence destruction runs through two things: who decides and when, and whether proof survives. A policy written in advance and applied uniformly to everyone is a retention policy. Deleting something retroactively to serve a specific dispute is spoliation - exactly what earned Google an adverse jury instruction in Epic v. Google. The mechanism is clean; the application can be dirty, and that has to be designed explicitly.

"This is a sales pitch for Hyperspell."

Yes, the source of this framing ends with a demo offer, and we said so at the start. The problem is real and sits in front of anyone rolling out enterprise AI search on any stack. Gartner, OWASP, the arXiv paper, and the Slack AI case have no connection to Hyperspell. A source's interest does not cancel its accuracy - it just means you verify separately.

Q&A

We already rolled out enterprise AI search - what should we check first?

Three questions worth asking right now. First: what does the system do with synthesized answers - where do they go, who sees them, how long do they persist? Second: does the agent's memory distinguish "this was stated directly" from "this was inferred"? If not, the system cannot tell a quote from an interpretation. Third: what sources can the agent technically read, even if you did not intend to connect them - Varonis data suggests an average of 25,000 folders are open to everyone. Start with an audit of what the agent can read, not what you meant to show it.

Does all of this mean meetings should not be recorded?

No. Recording meetings is useful - the question is what happens to the recording afterward. A transcript that stays with the participants and never enters an agent's memory is one situation. A transcript that becomes training material for a system that every employee can query is a different one entirely. A useful minimum: an explicit policy covering what from a recording enters long-term memory, and a flag set at the moment context is created rather than during offboarding.

What fields should every fact in agent memory carry?

Seven minimum fields: source and type (stated directly or inferred); who may receive it; permitted uses; memory lifespan; the condition under which the audience may change; what actions the agent may take on its basis; and a flag for "requires human confirmation." No major agent memory system implements all seven today - that is the current state of the market.

Is it enough to simply not connect sensitive sources?

That is a necessary condition, not a sufficient one. Aggregation inference means that three non-sensitive sources in combination can reveal something that none of them would have exposed individually. OWASP listed this as a separate risk precisely because input filtering does not solve it. Beyond that: "sensitive" is not a property of a source - it is a property of a specific claim in a specific context. A joke about the roadmap is not sensitive. That same joke, surfaced as a fact in a new hire's answer eight months later, is a different conversation entirely.

Majento builds AI agents and deploys them inside client companies on a forward-deployed model: engineers embed in the client's processes, find the bottleneck, build the system, and stay until it delivers results. Centralized agent context with project-level access control is part of our AI transformation framework, and we design rights at the point of creation rather than as a retrofit. To talk through your stack, reach out on Telegram at t.me/shimaoz or by email at hello@majento.ai.