[jaggederest]

The issue is when users interact with claude, what can they see? If the AI can see super-secret-payroll-details.md - is it allowed to discuss that with any user? is there some sort of internal ACL within claude that asks pretty please don't tell everyone they're underpaid?

That's why multiuser agents can be an issue.

The other way to do this, is to have claude installed for everyone, and any user's chat with claude uses their personal permissions via something like oauth delegation or AWS IAM role kinda things. But that, again, is complicated ACL logic living through the delegation of roles and access

[AlotOfReading]

I'm not sure the permissions problem is solved even if we assume models inherit user permissions. Imagine I'm a manager and someone contacts me about an HR incident involving one of my reports, or other sensitive information. The agent probably shouldn't have access unless I explicitly provide it.

[another-dave]

I would've thought you could solve that with multiple agents.

So rather than having "Claude" installed as a god-mode user in all channels, you have 10 instances of a bot running, each with their own context and ACLs.

For example, you could set it so that the agent's ACLs become the intersect of the least privileged user in all the channels it lives in - you try to add a bot to the "Executive Bonus discussion" and get told

> You can't add AliceBot to this channel because AliceBot is also in #intern-onboarding alongside 'Johnny Appleseed' and Johnny doesn't have access to this channel. Would you like to create a new bot?"

[jaggederest]

I am sorry to be the bearer of bad news: That is just massive ACLs and permissions issues with extra steps.