Memory is the asset. Models are rentals.
Models will keep changing. What compounds is what the company remembers: decisions, relationships, judgment, and outcomes. ENGRAM keeps the canonical estate stable while each generation of models rebuilds its own derived ways of seeing it.
A chatbot waits to be asked. A brain notices.
The fabric scores everything the company perceives and moves what matters to the people whose duties make it theirs, in seconds, unprompted, with the receiving context already attached.
Trust is the architecture.
At a company with customers, regulators, and secrets, speed without control is a liability. Every read is decided the moment it happens, walls are enforced in the graph itself, and every answer carries source, time, policy, and confidence. Governance is what makes the speed usable.
The anatomy
The whole brain in one figure, viewed from above. An always-on core routes, consolidates, and judges. Eight domain columns own their knowledge. A policy membrane checks every crossing. The outer ring holds a hundred thousand personal minds, one per person. Company systems feed events in on the left; open protocols exit on the right.
The stack
The same brain in side elevation: five planes and a rail. Perception seals events in. The substrate holds them, federated and bitemporal. Cognition distills overnight. Minds and routing deliver. Interop keeps the seams open. Governance is drawn as a rail across all five because every read in every plane clears it. Note the return arrows: what minds learn promotes back up, gatekept and credited.
Life of a signal
One pattern noticed by one payments-operations analyst. Within eight seconds, ten people and their agents across seven functions and seven cities hold briefs written in their own terms. Fourteen candidates were considered: one stopped at a privilege wall, three held for digests. Every decision landed on the ledger.
A payments-operations analyst flags the third rejection of a high-value cross-border payment batch since the morning open. The failures arrived through different client channels, but all share the same beneficiary-bank routing signature.
Press play. Every step below runs unprompted.
Blocked from the privileged root-cause and claim analysis. A separate operational summary is available; access to counsel's workstream requires counsel approval.
Pattern isolated: one reference-data release, 1,380 queued instructions, 61 clients, three correspondent routes. Safe revalidation sequence drafted.
Sanctions and financial-crime controls remain intact; this is a routing-data failure. Evidence preserved and the privileged legal workstream opened separately.
Exposure brief: 61 corporate clients, no posted duplicates, cutoff risk concentrated in two corridors. Recovery command path is ready.
The overnight BIC mapping release is the common change. Rollback and replay plan prepared against a clean pre-release snapshot.
Intraday liquidity remains inside limits. Three nostro positions may shift if the delayed instructions miss the next settlement window.
Your client has 214 queued instructions. A client-safe status note and expected release sequence are ready if outreach becomes necessary.
Incident threshold assessment opened. Current facts point to a contained reference-data event; escalation triggers are attached.
Three audience-specific messages are drafted for relationship teams, service channels, and affected clients; none will send without incident command approval.
Direct loss remains near zero if replay completes before cutoff; fee remediation and liquidity scenarios are modeled for slower recoveries.
Operational-resilience reportability assessment opened across the affected booking entities; notification thresholds and clocks are mapped.
Below this role's interrupt threshold. Folded into the evening digest with recovery status and client-impact projection attached.
No immediate action required. The complete decision trail is queued for the weekly control digest and next assurance review.
Outside the live incident window. A regional summary will arrive after the settlement cutoff with confirmed outcomes rather than provisional detail.
One of the hundred thousand
One person's mind in cross-section. Five layers form a private, user-visible workspace. Two form the membrane, the only doors between that workspace and the institution. Personal at the edge, institutional at the core, with enforced policy as the boundary.
Who you are, how you write, what you care about, what you never want to see. This layer makes drafts sound like you.
The live thread of today: open tasks, meetings in flight, half-finished drafts. Synced across your devices in real time.
Your visible history with your mind: decisions, corrections, drafts, and outcomes, replayable and editable by you. Colleagues and their minds cannot query it.
Your patch as you understand it: accounts, projects, cases, relationships. Your private annotations on the shared entity graph.
Your playbooks: how you run a launch, close a quarter, handle a difficult call. Promotable to the company library, with credit, when you choose.
Your window onto the company's fabric, computed fresh at every read. Two people ask the same question; each sees exactly their entitled view.
The gate on your focus. Interrupt, brief, digest, or silence, learned from your behavior, visible to you, always overrideable.
Identity, style, working context, episodic history, private annotations. Declared institutional records are captured through separate governed surfaces; no colleague and no colleague's agent can query your private mind.
When a playbook or insight is worth institutionalizing, you promote it through a gatekeeper. Attribution rides the atom permanently: when your memory helps someone win, the ledger records that it was yours. Sharing stops costing the person who shares.
Institutional signal arrives already translated: your entitled view, your accounts' relevance, your next action, your tone. Ten recipients of the same fact read ten different first sentences.
Always-on intelligence fails if it becomes always-on interruption. Every delivery passes your firewall in one of four modes: interrupt, brief, digest, silence. Budgets are learned from you and visible to you, and routing precision is tracked as a company-level KPI.
The memory lifecycle
Every atom in the fabric moves through the same eight stations, from capture to scheduled decay. Cyan stations move signal; amber stations govern it. The sequence doubles as the audit trail.
- 01Capture
An interaction, document, or event becomes a sealed memory atom, with provenance, consent, and classification stamped at ingress.
- 02Resolve
Entities bind to the canonical graph and duplicates match. The atom takes its place in the company's web of who, what, and when.
- 03Triage
Salience scores the atom. The exceptional route hot to the router; the rest queue for overnight consolidation.
- 04Consolidate
Merged, abstracted, cross-linked, contradiction-checked. Episodic events distill into semantic knowledge.
- 05Certify
Gatekeeper councils promote working knowledge to certified. Disputes resolve in the open, and both lineages persist.
- 06Distribute
Subscribed minds receive it, trimmed by policy, framed per receiver, dosed by each attention firewall.
- 07Reinforce
Successful outcomes, explicit feedback, and repeated usefulness strengthen the pathways that carried it. Raw popularity alone never changes truth or trust tier, and credit flows back to the sources.
- 08Decay & hold
Untouched detail fades to cold tiers on schedule. Nothing deletes before retention law, and legal holds stop decay entirely.
Governance
Shared agent memory fails in four documented ways: leakage, stale propagation, contradiction persistence, and provenance collapse. Each has a specific answer in this design. At any company with customers, regulators, and secrets, this plane is what makes the rest usable. The wall that separated the vendor director from the privileged workstream is the same machinery that cleared the other ten briefs inside the design envelope.
Access is a live decision. Every recall is trimmed against the relationship lattice at the moment it happens, so a revocation anywhere is effective everywhere within a second.
Information barriers are cuts in the graph, not filters over search results. Privilege, deal rooms, and investigations fail closed, offer a logged escalation, and record the attempt as evidence the wall works.
Raw, working, certified. Human stewards paired with AI reviewers certify what the company treats as true. Every answer cites its tier, and certified atoms carry their council's signature.
Two clocks make any historical knowledge state reconstructible: when a fact was true, and when the company learned it. Audit mode mounts the company's brain as of any timestamp, read-only, in under a minute.
Personal memory and institutional records remain distinct. Declared supervisory records enter through governed institutional surfaces rather than silently opening a person's private mind. Erasure tombstones content while the required audit skeleton remains.
Red-team agents probe for leak paths around the clock: wall circumvention, inference attacks, prompt exfiltration. Every model change shadow-runs against memory-grounded benchmarks before touching production cognition.
Interop
Choosing the wrong model costs a contract cycle. Renting your memory from a model vendor costs the institution. In ENGRAM the fabric belongs to the company; models, tools, and platforms attach through open protocols and detach without taking the canonical memory with them. MCP exposes tools and context. A2A coordinates agents. The memory contract preserves identity, time, provenance, policy, and lineage across both. Click any port for its dossier.
Scale & speed
Compute and inference are assumed abundant. The engineering problem is coordination under governance, and these numbers are the design contract for it.
Each domain column is a cell: shardable, movable, independently upgradeable. The spine is small and replicated everywhere. A failure's blast radius is one cell, and the worst case is a brain that briefly stops learning while it keeps recalling.
Biology accelerates useful pathways, and so does the fabric. Recall routes supported by successful outcomes, explicit feedback, and repeated usefulness earn materialized subgraphs, precomputed embeddings, and caches near their minds. Optimization changes speed and ranking, never truth or trust tier.
Every schema is versioned and every canonical atom survives behind a contract. Models can change without rewriting the institution's evidence or claims; model-specific embeddings, summaries, scores, and indexes are versioned, rebuilt, compared, and retired around that stable core.
The component landscape
The ingredients already exist across several product categories. The 2028 opportunity is not to pretend they are absent; it is to compose their strongest components into one governed memory fabric spanning institution, person, model, and agent.
Broad employee reach, native work surfaces, identity, source-permission trimming, and increasingly persistent personal context.
The center of gravity is the assistant suite: organizational memory, consolidation, and cross-tool portability remain separate concerns.
Permission-aware retrieval across large application estates, strong entity context, source citations, and mature connector ecosystems.
Optimized primarily for finding and answering; durable episodic learning, governed consolidation, and proactive delivery vary by platform.
Orchestration, delegation, tool use, asynchronous work, specialized roles, and increasingly rich traces of what agents attempted and produced.
State commonly belongs to a task, agent, or application. Shared institutional memory and durable learning across the fleet are separate layers.
Long-term personal memory, temporal graphs, governed write-back, shared semantics, entity resolution, and durable operational context.
These systems solve different layers and scopes. The open design space is their composition into one governed personal-to-institutional fabric.
A complete, user-visible, editable memory for every employee, at full depth.
A shared, bitemporal organizational memory whose every read and write inherits source entitlements.
Sleep-time distillation with lawful forgetting: decay, supersession, retention, and holds as first-class operations.
Salience-driven routing to the specific people and agents concerned, trimmed by policy, dosed by attention budgets.
ENGRAM's design question is what changes when all four become properties of one architecture rather than capabilities purchased and operated in isolation.
Everyone gets the same models.
The advantage is what a company remembers, and how fast the right people learn it. ENGRAM is a blueprint for that machinery.