The Problem with Autonomous Memory

Most attempts to build a "company brain" fail because they either become isolated silos (per-channel memory) or create security nightmares where agents leak sensitive data (e.g., compensation details) because they lack context-aware access controls. Tanmai Gopal argues that the industry's obsession with fully autonomous agents that "auto-learn" is a trap. When an agent writes to its own memory without human oversight, it creates a black box where secrets can be ingested and exposed without accountability.

The Architecture of a Healthy Brain

A healthy company brain is not a static database but a living, growing wiki of linked markdown files. Gopal’s team at PromptQL models their brain as 5,000 interconnected pages. The key to scaling this is not automation, but human-in-the-loop contribution.

The Three Core Rules for Security:

  1. Unified Wiki, Not Silos: All context must reside in a single, company-wide wiki. This prevents knowledge fragmentation.
  2. Human-Verified Writes: Never allow an agent to write to the brain autonomously. The agent should propose facts and scopes, but a human must review and accept the change. This ensures that every piece of knowledge is attributed to a specific person.
  3. Granular Scoping: Every file or page in the wiki must have explicit read/write access controls. When an agent performs a task, it must act on behalf of the user, using that user's specific credentials to access only the parts of the wiki they are authorized to see.

The Multiplayer Advantage

The most valuable knowledge is often generated during collaborative problem-solving, such as incident management. In these scenarios, the "argument" between team members is the knowledge. By injecting credentials at the HTTP and SQL layers rather than storing them in the agent's sandbox, teams can collaborate on sensitive tasks without risking privilege escalation. The agent acts as a facilitator, surfacing context and proposing solutions, while the humans provide the final judgment and accountability.

Key Takeaways

  • Grow, Don't Build: A company brain cannot be built in a single project. It must be grown organically as employees document their daily work.
  • Accountability is Security: Every entry in the brain must carry a human name. If a leak occurs, you must know exactly who authorized that piece of information.
  • Reject Silent Writes: If an agent is writing to your knowledge base without a human review, you have lost control of your data security.
  • Credential Injection: Never store credentials in an agent's sandbox. Always inject them per-user at the application layer to ensure the agent respects existing organizational permissions.
  • Measure Health by Growth: A healthy brain shows a steady, increasing rate of updates. This indicates that as the system becomes more useful, users are actively teaching it more skills and context.

Notable Quotes

  • "If you have a system that starts to work, what happens is people start to teach it a lot more... A healthy brain of course the overall size keeps increasing but even your daily updates per day kind of keep increasing as well."
  • "We're going to grow a company brain, we're not going to build one. We're going to let it come together."
  • "Nothing should be allowed inside the wiki that is 'Claude added this' or 'your AI agent added this'—no, Tanmai added this. That name needs to be there so that you can tie it back to this is the person who screwed up."
  • "The technical decision that we've made here is wrong... now two people start to have an argument. They have the multiplayer case, where the argument itself produces the best knowledge."