Personal-2-Company Brain

Inspiration

Everyone is getting a personal AI that knows their work, and companies want that knowledge. The obvious way to connect the two is for the employer to read the employee's AI. That is surveillance. We wanted the opposite: a company brain that gets smarter without ever reading a personal brain.

What it does

Personal brain (Jarvis). Each employee's notes, skills, projects and blockers. Every item is private unless its owner releases it.
The bridge. One gate, in code, between the two brains. Only what the owner released crosses. Every request needs an approved purpose and is logged on the owner's side. Health, family, finances and anything locked never leave. Of what stays private, the company sees one coarse range ("a few private work items"), never titles or counts.
Role tiers. In the other direction, an employee reads company data by role and clearance, defined when the role is opened for hiring.
Company brain. Uses what was released to connect people: who already solved what blocks someone else, who has the skill a project needs, where two people are doing the same work. It suggests; a person decides.

How we built it

Three people, three parts, one contract: markdown notes with a share: tag. Python standard library for the bridge and the local servers, plain HTML and JavaScript for the two interfaces, Claude Code to build. No database: a brain is a folder.

Challenges we ran into

We built in parallel and ended up with three different sharing rules. We ran an audit agent on our own repo and it found private note text inside the company page. We fixed it by making every export call one function, and we wrote down what is still open.

What we learned

The boundary is the product. Search and matching are commodity.
Consent at work is weak, so the employee's approval is a safeguard, not the legal basis, and saying no must cost nothing. We removed a points scoreboard for that reason.
A policy only counts if code enforces it and a test fails when it breaks.

What's next

Signed requests between machines, recall of what was derived from a note that is later withdrawn, and real matching in place of the demo's scripted matches.