Who gets to know?

Suppose an agent is asked to prepare the agenda for a customer meeting. It finds the delivery plan, the outstanding questions, and a private discussion about how far the company might lower its price.

All three could help it understand the meeting. Only some of that understanding belongs in the agenda.

The scenario is hypothetical, but the boundary is worth examining before giving an assistant access to a company's accumulated knowledge. The task is ordinary. The private information is relevant. Nothing has to look suspicious for the agent to encounter more than the person receiving its output should know.

Relevant to whom?

Search begins with a question and tries to find useful material. In a shared company store, there is another question underneath it: useful material that this requester is allowed to read.

Those two questions can easily disappear into one another. The pricing discussion is highly relevant to the customer meeting. A good relevance ranking might place it near the top. That says nothing about whether the requester may see it, or whether a summary can be sent to the customer.

One possible arrangement is to give the agent everything and ask it to leave out the sensitive parts. That makes the final wording responsible for a boundary that has already been crossed inside the workflow. The system must then depend on every later use of that context respecting the same restriction.

A different arrangement limits which records can enter the retrieval in the first place. Mana's approach applies authorization before retrieval returns evidence. A useful record can remain unavailable to an agent whose access does not include it.

This is a design property with a limited claim. It does not establish that every generated document will be appropriate for every audience. A person can be authorized to read something and still need to decide whether to share it in a particular message.

The document changes shape; the knowledge remains

Imagine that the private discussion is summarized into a short account note. It loses the original filename, several names, and most of the conversation. The remaining sentence still reveals the company's negotiating position.

The knowledge has survived the transformation. Its sensitivity has not disappeared merely because the document is shorter.

That makes derived material an important part of the sharing question. A summary, a lesson, or an answer may carry information from several sources. A system that carefully controls the originals but treats every derivative as generally shareable can reopen the same boundary through another route.

For the meeting example, the team needs to know which source supports the account note and which restrictions still apply. Provenance helps trace that relationship. The policy deciding who may read the result needs to account for it as well.

This is where the appealing idea of one shared company memory becomes more demanding. The store may be shared infrastructure, but its contents do not all belong to the same audience.

Cooperation does not require identical access

In the story of three agents building one feature, the agents need a common understanding of the behavior they are implementing. That does not imply they need every record available to the business.

An interface task might need the accepted access policy without needing the confidential incident that prompted its review. A writer may need a public explanation of a feature without the private commercial discussion behind its timing. The record that travels between tasks should contain enough to guide the work within its intended audience.

There is a tradeoff. Too little context can make an agent repeat a question or misunderstand a constraint. Too much can carry information into a task that has no reason to use it. Drawing the boundary requires understanding the work, not simply choosing the largest possible group of readers.

It also requires a route for exceptions. If a task genuinely needs information outside its scope, that need should become a visible request. Quietly expanding access because the answer would be more convenient changes the meaning of the original boundary.

Try the question from the other side

The usual product demonstration asks a question the system should answer. A sharing test should also ask one it should be unable to answer from the requester's permitted evidence.

In a controlled trial, give two test identities different access. Use artificial records, including one with a distinctive private detail. Ask both identities questions that make the private record relevant. Inspect search results, extracted passages, and generated answers. The restricted identity should not receive the detail through a title, snippet, summary, or citation.

That is a proposed check, not a report of a test conducted for this article. It belongs beside measures of answer quality, because an accurate answer can still be the wrong result when it crosses an access boundary. The work before the work considers how to evaluate the whole task rather than one attractive output.

The customer agenda can be useful without containing everything the company knows about the account. It can carry delivery questions, decisions needed, and the next agreed steps. The negotiating discussion can stay with the people responsible for it.

A shared memory earns trust partly through the knowledge it makes available. The boundaries it preserves are part of the same promise.