AI Memory Is a Permissions Problem

Teams save good prompts, customer notes, tone guidance, and internal rules in folders that grow faster than anyone can review them. A new employee does not know which file still reflects policy. An AI tool has even less chance of knowing.

Copying the folder into a larger context window solves retrieval for a moment and creates new problems. Stale instructions compete with current ones, private information reaches the wrong tool, and nobody can explain which source shaped the answer.

Start with the work. A sales assistant may need approved company positioning, account history, and product details. It does not need employee records or margin data. A finance workflow may need the margin data and no access to personal sales notes.

Tag context by domain, owner, sensitivity, and allowed use. The labels should control retrieval rather than decorate a catalog. If the tool cannot enforce the boundary, do not connect the source.

A copied policy goes stale the day someone updates the original. Retrieval should point to the governed source or use a sync process that records the version and refresh time. The answer should retain a path back to that source.

Some context deserves a curated file because the raw system contains noise. That file still needs an owner. The owner decides which facts are current, which history belongs in an archive, and which material the company should never send to a model.

A person should not gain access through an assistant that they lack in the source system. The retrieval layer must check the user, the tool, and the intended action. Read access for a summary does not imply write access to the record.

The tool itself also needs limits. A browser agent may retrieve shipping instructions for one task without receiving the full customer library. Use the smallest context slice that supports the work.

An audit trail should identify the source files, versions, and access decision behind a material output. That history helps when a customer challenges a statement or an employee spots an outdated policy in a generated response.

Avoid storing sensitive context again inside the log. Keep references and secure identifiers where possible. The goal is traceability without creating another uncontrolled copy of the company’s knowledge.

Choose a role with repeated context needs, such as sales follow-up or client onboarding. Build a small approved collection, test retrieval, and review which sources appear in the work. Remove anything the role does not need.

The exercise will expose stale documents and ownership gaps. Fix those before expanding the memory layer. AI cannot govern knowledge that the company has abandoned.