Permissioned inference is harder than permissioned retrieval — enterprise context graphs need reasoning-level access control

Enterprise decision traces are too sensitive for ordinary access controls. A law firm cannot let one client’s precedent quietly shape reasoning for a competitor. A healthcare organization cannot allow operational history to leak through abstraction. The companies that solve this earn trust that compounds just as surely as the data itself.

Traditional access control answers “who can see this data?” Permissioned inference must answer a harder question: “whose decision history can influence reasoning about this new case?” When context graphs become dense enough to shift from retrieval (“how did we handle this last time?”) to prediction (“what’s likely to happen if we structure the deal this way?”), the reasoning itself becomes a vector for information leakage.

This extends Trust boundaries must be externalized — not held in engineers' heads from agent behavior boundaries to data influence boundaries — not just where the agent is well-understood, but where its reasoning draws from appropriate precedent. It also adds a critical qualifier to Systems of record keep what was decided, not why — capture the reasoning at the moment a decision becomes binding: capturing decision traces at scale creates a new category of security problem that traditional permissioning doesn’t address. And it explains why When non-deterministic AI feeds a deterministic system, the deterministic layer governs — software that owns coordination and accountability keeps its place — the governance layer must now enforce inference boundaries, not just data access boundaries.

It is also the hard edge of Consolidating your context doesn't create the risk — it takes custody of a risk you already had. Tan argues that consolidating your life into a repo you own does not create the risk but takes custody of one already scattered across ten clouds — a strong answer to the leak objection that nonetheless leaves this problem untouched, because an agent reasoning over everything at once is exactly the case where retrieval-level permissions stop being sufficient.