Your company brain will leak secrets: how we stopped it for big banks — Tanmai Gopal, PromptQL

Tanmai Gopal, co-founder of PromptQL and architect of the Hasura GraphQL engine, addresses the critical challenge of preventing data leaks in “company brains” – shared knowledge systems powered by AI agents. He emphasizes that this security concern is a primary barrier hindering the widespread deployment of advanced AI tools within organizations.

Background and Experience

Gopal’s team at PromptQL leverages their extensive experience with data access and security gained from the Hasura GraphQL engine, which was deployed across major enterprises from Apple to JP Morgan. This background provides a nuanced understanding of data security in complex environments. Over the past year, PromptQL has partnered with diverse organizations—from flexible AI-native startups to tech-forward companies like Instacart, and highly regulated Fortune 100 banks—to deploy early versions of company brains, demonstrating the wide applicability and varying security demands of such systems. Their internal company brain, modeled as approximately 5,000 interconnected wiki pages, serves as a practical blueprint.

The Healthy Company Brain: A Rising Edit Curve

Gopal observes a surprising metric for a healthy company brain: a continuously increasing curve of daily edits. While one might expect initial enthusiasm followed by neglect, or fluctuating contributions, their internal data showed a steady upward trend. This phenomenon suggests that “if you have a system that starts to work, what happens is people start to teach it a lot more.” Each new skill taught to the agent—from querying data to interpreting results and taking action—contributes its own steady rate of correction, leading to persistent growth in contributions. This rising edit count is indicative of trust and ongoing engagement, signifying a healthy, evolving knowledge base.

Key Use Cases for Company Brains

Gopal identifies two primary use cases for these AI-powered knowledge systems:

1. Personal Recall: An individual agent leveraging the company brain to assist with personal tasks, such as automatically answering a customer’s security questionnaire by drawing from collective knowledge.
2. Shared Work (Multiplayer): Collaborative problem-solving, like incident management, where multiple individuals interact with a shared AI to perform complex, multi-step tasks (e.g., fetching logs, investigating code, raising PRs, deploying to staging, and setting alerts).

Defining the Company Brain and its Development Philosophy

Gopal defines a company brain as “shared context that you’d put in a markdown” combined with “access control rules for the different data and tools that you want to access as given to a coding agent.” He clarifies that this is not a general-purpose AI, but a coding agent designed to solve specific problems. Crucially, he advocates for a decentralized approach to building: “We’re going to grow a company brain. We’re not going to build one.” This means empowering each employee to contribute and own their part of the brain, rather than attempting a monolithic, top-down construction.

Addressing the “Leak” Problem: Dismissed and Proposed Solutions

Gopal dismisses two common, yet ineffective, approaches to shared knowledge:

• Writing Shared Skills on GitHub: This is unrealistic because “Nobody is going to write skills for another person in GitHub.” The effort required to formalize and maintain skills for unknown future colleagues is too high for day-to-day work.
• Team Brains/Per-Channel Memory: While seemingly useful, a team-specific brain or per-channel memory (like in Slack) merely creates “one more silo.” This prevents the cross-functional knowledge sharing essential for a true company-wide brain.

The Proposed Secure Architecture:

To overcome these limitations and ensure security, Gopal proposes a three-pronged approach:

1. Unified Company-Wide Wiki: All context must reside in a single, interconnected wiki of linked markdown files. This centralization is fundamental, moving away from fragmented, siloed information.
2. Scoped Access Control: Each file or wiki page must have granular read and write access controls, allowing administrators to define who can view or modify specific pieces of information.
3. Human-in-the-Loop for Writes (No Silent Writes): The AI agent should not autonomously add or modify information. Instead, it must suggest changes, including proposed content and access scopes. A human then reviews and explicitly accepts or rejects these suggestions. This prevents unintended data exposure and maintains oversight.

Crucially, “Every change carries a human name.” This accountability mechanism ensures that if sensitive information is accidentally exposed due to incorrect scoping, the human who approved the change is identifiable, allowing for remedial action. This process balances the efficiency of AI suggestions with human responsibility.

Security for the Multiplayer Case: Argument as Knowledge

For the complex “multiplayer” scenario, where collaborative discussions and debugging (e.g., in a Slack thread) generate the highest quality knowledge, privilege escalation becomes a significant concern. An agent might need to perform diverse actions—from reading logs to deploying code—each requiring different access levels. Storing credentials within the agent’s sandbox is a major security risk.

Gopal’s solution:

• No Credentials in Sandbox: Credentials are never stored within the agent’s environment.
• Dynamic Credential Injection: Instead, user credentials are dynamically injected per user at the HTTP and SQL layers when the agent executes tools. This allows the AI to operate “as the human” with their specific, limited privileges, enabling secure, contextual interactions across varying authorization levels without compromising the system.

Overarching Security Principles

These architectural decisions are guided by two fundamental principles:

1. Do not store credentials in the cloud sandbox.
2. Virtualize all interactions with real data. Proxying and virtualizing data interactions, coupled with user control over tools, forms the backbone of a secure and scalable company brain architecture.

These principles, when rigorously applied, lead to an architecture that effectively manages context and tools while upholding stringent security standards.

• Tags:
• AI Agents
• Feature
• LLM Security
• Knowledge Management
• PromptQL
• Human-in-the-Loop
• Privilege Escalation
• Data Security
• Company Brain
• Access Control
• Hasura GraphQL