{ "video": { "id": "0uC6u0lJJl4", "title": "Your company brain will leak secrets: how we stopped it for big banks — Tanmai Gopal, PromptQL", "duration": 1585, "upload_date": null, "channel": "AI Engineer", "source": "AI Engineer" }, "analysis": { "video_id": "0uC6u0lJJl4", "title": "Your company brain will leak secrets: how we stopped it for big banks — Tanmai Gopal, PromptQL", "one_liner": "Tanmai Gopal (PromptQL, ex-Hasura) argues a company brain is just shared markdown context plus per-file access-control rules handed to a coding agent, and the only way to keep it from leaking secrets is to make the agent *suggest* memory with scopes for a named human to accept, and to inject the user's own credentials at the HTTP/SQL layer instead of storing them in the sandbox.", "summary": "Drawing on deployments at 15–20 companies ranging from AI-natives to Instacart-style tech-forward firms to Fortune banks, Tanmai defines a 'company brain' narrowly: shared context in markdown files plus access-control rules for data and tools, given to a coding agent — not a giant knowledge graph. He shows why the two obvious approaches fail (nobody writes shared skills in GitHub for strangers; per-team/per-channel agent memory is just another silo) and proposes one company-wide interlinked wiki where every page carries read/write scopes and the agent proposes edits that a named human accepts or rejects. For the harder multiplayer case — several people with different privilege levels debugging an incident together, which is where the highest-quality knowledge is created — he says never store credentials in the sandbox and instead virtualize every real-data interaction, injecting the acting user's credentials so the AI behaves as that human.", "key_points": [ "His definition, stated as a constraint: a company brain is shared context you'd put in markdown files plus access-control rules for the data and tools, given to a coding agent — explicitly not knowledge pulled into a general-purpose LLM doing tool calls, and not a giant knowledge graph ('that hasn't worked, won't work'). Claude Cowork and the Codex app are the same architecture.", "Audience poll on what daily updates to a healthy company brain look like: their own PromptQL wiki (~5,000 interconnected pages) plotted over two months showed a gently but continuously *increasing* number of updates per day, which surprised him — once a system works, people keep teaching it new skills on top of old ones, and each skill has its own steady error rate that adds up.", "Failure mode 1 — shared skills in GitHub: after slogging through a giant Excel security questionnaire, your compliance person is not going to go update a shared skill repo. 'I can barely get it to curate my own memory and my context.'", "Failure mode 2 — team brain / agent-in-Slack that autosaves memory: it works but is 'one more silo'; he cites per-channel memory, where knowledge is locked to whoever happens to be in that channel.", "The proposal, in three parts: (1) all context goes into one company-wide wiki of interlinked markdown files; (2) each file carries scopes for who can read/write; (3) the agent never auto-adds — it suggests bullets with proposed scopes and a human hits 'add to wiki'. Lighter than a GitHub PR review, less yolo than autowritten memory.", "Rule two: every change is backed by a human's name — nothing in the wiki may say 'Claude added this' or 'Hermes added this'; it says 'Tanmai added this', so you can trace who exposed everyone's comp and take remedial action.", "Demo 1: an emailed security questionnaire from 'Dave at StitchFix' answered from the company brain (trust center, gateway details) and the draft reply sent — knowledge that presumably came from a colleague who had answered the same questionnaire earlier.", "Demo 2 (the 'big daddy' use case): a real SRE thread where wiki auto-learning was failing — a human corrects Opus 4.5 to use an OpenTelemetry span name, then to use an equals query instead of a LIKE query; the agent surfaces those as learnings. A second person joins and argues the underlying technical decision was wrong and undocumented, which upgrades the captured fact from 'pages have a prefix' to 'pages should not have a prefix; if they do it causes lookup issues in prod'.", "The multiplayer security problem: the engineer was cleared to raise the PR, but the same shared agent can deploy to prod — in a bank, the people who debug, deploy to staging, set alerts and deploy to prod are deliberately different, yet keeping them in one conversation is exactly where the knowledge comes from.", "Second architecture, stated as principles to work backwards from: never store credentials in the cloud sandbox; virtualize/proxy every interaction with real data, injecting the user's credentials at the HTTP layer and the SQL layer so the AI acts as that human; and let the user who adds a tool control who gets access to it." ], "takeaways": [ "Stop letting your agent autowrite memory. Change the UX so it proposes the facts it wants to save, with proposed scopes, and a human reviews the bullets — the reviewer should only have to judge 'are these facts correct?', not which markdown file they land in.", "Put everything in one company-wide wiki and don't back down from that rule; per-team or per-channel agent memory just creates another silo that the next person can't reach.", "Attribute every wiki change to a named person, never to the agent, so an over-broad scope is traceable to whoever approved it.", "Have the agent read context using the acting user's claims on every read, and inject that user's credentials at the HTTP/SQL layer at execution time rather than putting any credential in the sandbox — that's what lets several people at different privilege levels share one agent.", "Don't try to build the company brain as a project; grow it by letting each person self-serve the part of it they already own. 'You can't build a company brain for an organization that's 100 years old — you can barely build it for your own family.'", "Track daily updates-per-day to your shared skills/context repo as a health metric: a flat or declining curve means the enthusiasm spike died; a rising one means it's actually working." ], "topics": [ "agents", "security", "access-control", "memory", "knowledge-management", "coding-agents", "multi-agent", "enterprise" ], "tools": [ "PromptQL", "Hasura GraphQL Engine", "Claude Code", "Claude Cowork", "Codex app", "Opus 4.5", "Hermes", "OpenClaw", "GitHub", "Slack", "OpenTelemetry", "GLM", "GPT", "JP Morgan", "Instacart", "Apple", "Meta", "StitchFix" ], "quotes": [ { "text": "Nobody is going to write skills for another person in GitHub like that is not that is not something that is natural to us right in the dayto-day of doing work", "at": "13:18", "url": "https://www.youtube.com/watch?v=0uC6u0lJJl4&t=798s" }, { "text": "You don't let the agent auto add because if it auto adds, you have no idea what happened", "at": "15:49", "url": "https://www.youtube.com/watch?v=0uC6u0lJJl4&t=949s" }, { "text": "Nothing should be allowed inside the wiki that is Claude added this or like your AI agent added this or Hermes added this. No, Tanme added this.", "at": "18:48", "url": "https://www.youtube.com/watch?v=0uC6u0lJJl4&t=1128s" }, { "text": "This is what happens in a Slack thread. When two people talk to each other and solve a problem, it creates the highest quality context.", "at": "22:57", "url": "https://www.youtube.com/watch?v=0uC6u0lJJl4&t=1377s" }, { "text": "So never store credentials in the sandbox. Instead of that at the HTTP layer, at the SQL layer, inject the user's credentials, allowing the AI to behave as the human in a particular interaction", "at": "24:03", "url": "https://www.youtube.com/watch?v=0uC6u0lJJl4&t=1443s" } ], "words": 5764 }, "summary_url": "/#0uC6u0lJJl4", "transcript": { "html": "/transcripts/0uC6u0lJJl4.html", "txt": "/transcripts/0uC6u0lJJl4.txt", "vtt": "/transcripts/0uC6u0lJJl4.vtt" } }