Who Is in the Room Is the Wrong Question

Three open platforms now let your clients talk to your AI agent. None of them can control which of your memories the agent reveals to whom.

Here is a requirement that sounds ordinary and turns out to be an open problem. A consultant runs an AI agent loaded with years of working knowledge. Two client teams should each get access to that agent. Client A must never see client B. And, harder: the agent knows things about the consultant's other work that neither client should hear, so every memory that becomes visible to a client should pass through the consultant's hands first.

I evaluated the three leading open-source platforms for agent-and-human collaboration against this, at source level. Cumora is a team chat where agents are first-class members alongside humans. Buzz, from Block, is a signed-event relay workspace. Multica is an issue board where agents appear as assignees. All three are serious, maintained projects.

All three fail the requirement, and they fail in the same place. Each scopes access by membership: by company, by keypair, by workspace. Every one of them can answer the question "who is in the room". None of them can answer "which of the things this agent knows may be said in this room". The memory follows the agent, and everyone in the room with the agent gets the benefit of everything it remembers. There is no per-memory audience, no grant table, no approval step anywhere in the memory path, on any of the three.

The entire field has drawn its security boundary at the door of the room. Professional confidentiality lives one level down, at the sentence.

What the Evaluation Also Turned Up

Two findings along the way matter to anyone making the same choice. First, read the licence past the first line. Multica is Apache-licensed plus one extra condition prohibiting use of the source to offer a hosted service to third parties, which is precisely what an agency hosting agents for clients would be doing. The licence, not the feature list, excluded it.

Second, follow the data path all the way. Cumora, the platform with the cleanest tenant isolation of the three, still embeds every memory through OpenAI's API before it becomes searchable. Running your own reasoning model does not remove that dependency. For client data under Malaysian PDPA or any confidentiality undertaking, a mandatory third-country processing step in the memory path is a contract question, not a technical footnote.

The Workable Answer

The control that closes the gap is a provisioning gate: the agent captures memory freely, and each item reaches a wider audience only when a named human promotes it. If the platform's isolation unit is the agent, work with that grain. One agent per client, each a hard memory boundary, with human-approved promotion of individual items between them. That reuses the isolation guarantee the platform already enforces instead of patching a new permission check into a retrieval path where one mistake reopens the tenancy hole.

Until some platform ships the gate natively, this is a build-versus-wait decision. The evaluation says: small build, big scarcity. Nobody ships it today.

Part of the Knowledge Management series from KG Consultancy.