Need to know

A workspace decides which body of evidence a reader may reach. Need to know decides which of that evidence they are entitled to see. The two compose, and neither can widen the other.

This is the difference between "which projects is this person on" and "should this fact reach this person". Only the second answers the question a company actually has when it puts AI workers next to its executive channel.

Four levels

Classified when it arrives, not when it is read

Every ingested event is classified at the moment it lands, in the same pass that assesses taint. Both are facts about that moment and neither is recoverable later: the rules will have moved on, and the audience is a question about who the company was when the thing was said.

Classification is deterministic. Patterns over the fact's own words, with no model in the path, for the same reason the runtime keeps one out of its decision path: a boundary a model can be talked out of is not a boundary.

The cost is worth naming. Patterns over-classify, so a rule sometimes hides something that did not need hiding. That is the direction to fail in, and an admin can reclassify a single fact for the rest.

What a reader holds

A clearance is a ceiling, the names an audience can admit them by, and whether they are a person.

An access role is not a clearance. Being able to change a rule set is not the same as being entitled to read a compensation thread, so an admin reaches confidential and only org-wide access reaches restricted.

An agent never out-reads its principal

An ask grant can name the person the agent works for. When it does, the effective clearance is the weaker of the two on both axes: the lower ceiling, and only the audiences they are both in.

Grant an agent reach into Legal while its principal sits in Finance and the grant has bought nothing. That is the safe reading of a contradiction. An AI worker is not a second, quieter route to what its owner could not open themselves.

It is resolved live on every question, so moving somebody between departments bites on the next thing their agent asks. A principal who is no longer a member narrows their agent to nothing rather than freeing it.

How far extraction reads is your decision

The extractor reads the company's own record by default and nothing narrower. Raising it with extraction.readsUpTo sends confidential material to a model provider, which is a decision about your data rather than one Memnox makes for you.

Raising it is safe on the way out. A suggestion inherits the strongest classification of its evidence and the union of every audience at that level, and the review queue is filtered by the reviewer's own clearance. The summary of a secret is not less secret than the secret.

Restricted is not a value. A machine never reads it, whatever is configured.

Restricted never reaches a machine

Whatever a grant was minted with. It is refused in the predicate itself, and grants above confidential are refused at the mint route rather than quietly lowered, so an admin who believed something wrong about an agent finds out immediately.

Every answer says what it withheld

A context answer carries a withheld count. An agent that does not know it was filtered will report a partial answer as a complete one, which is worse than refusing it outright. A non-zero count is a reason to ask a person.

A rule listing counts its terms rather than naming them. A list of the words that hide a thread is a map to the threads it hides.