Agent scope isolation

Giving each person and each room its own memory, files, keychain view, permissions, crons, web apps and durable sandbox, so one agent deployment serves an organization without the users sharing state. From qm, which is the first source here built around the problem.

The shape every other agent in this corpus has

Almost everything this spoke documents is one agent, one principal. A coding harness runs as the developer who launched it. auto-company‘s 14-agent loop keeps its whole cross-cycle state in one consensus.md. agent-memory is written throughout as the agent’s memory. Where multiple agents appear, they are orchestrated workers of a single user, not separate users.

qm names that as the design it is rejecting: “Most agents are designed like personal assistants. You can make one work for a whole company, but it quickly gets complex.” The complexity it points at is the part nobody in this corpus had costed — once two employees share one agent, every stateful thing the agent has needs an owner.

What has to become scoped

The list is the useful part, because each item is a subsystem this wiki pages separately:

• Memory — per-person and per-room, so what the agent learned for you is not retrievable by a colleague. agent-memory treats continuity as the goal; this adds whose continuity.
• Files and the sandbox — each scope gets a durable computer where installed tools stay installed. Persistence and isolation at once, which is harder than either.
• Keychain view — not just which credentials exist but which a given scope can see.
• Permissions and skills — agent-skills become scope-owned and shareable by grant, with admin-gated promotion to the whole org.
• Crons and background work — scheduled work runs as somebody, with that somebody’s reach.

Two structural rules make it tractable in qm‘s telling. Identity and configuration carry across surfaces — the same principal in Slack and the web app — so a scope is a property of the person, not the client. And the org picks one security posture that narrower scopes may only tighten, never loosen: a ceiling set centrally, with local discretion running one direction.

Where it is hard, in the source’s own words

qm‘s SECURITY.md is unusually direct that scoping is enforced around the model, never by it: “The agent and software it runs in a sandbox are not trusted to make authorization decisions.” Core resolves a principal per turn, separates workspaces, signs ingress and capability tokens, and applies grants and audience checks.

And then the gaps, which show what the hard part actually is:

• The sandbox holds usable credentials in plaintext while in use, so scope isolation limits blast radius without preventing a compromised agent process from spending or exfiltrating them.
• Audience-floor filtering is incomplete — model-context entries don’t all carry origin labels, so mixed-permission filtering has known gaps.
• Admins read across scopes by design, audited but not consent-gated.
• Its own summary: these controls “are not a formal non-interference proof or a guarantee that the model cannot disclose data.”

That last line is the honest statement of the whole problem. Scope isolation is enforceable for access — what the agent can fetch — and not for disclosure, since a model that legitimately read something can repeat it into a room that shouldn’t have it. Nothing in this corpus solves that.

Why it is worth a page on one source

It reframes several open threads at once. agent-guardrails bounds autonomy by recovery cost, a single-user frame; multi-user adds whose data a bad step reaches. agent-memory‘s unpriced range (one markdown file vs a forkable store) gains a constraint that argues against the markdown pole — one file cannot hold per-scope views. And the org-level posture with local tightening is a governance shape the spoke had not seen: not a per-run permission prompt, and not a constitution in prose, but a policy ceiling with a non-negotiable effects floor beneath it.

One source deep, five days old, and no deployment evidence beyond its publisher’s own. The design problem is real regardless of whether this implementation is.

Related

qm · agent-memory · agent-guardrails · agent-orchestration · agent-skills · auto-company · synthesis