Meaning
What does each business term mean, and where do teams disagree?
Company context and memory
What is a company brain for AI?
A company brain is the governed context layer that lets AI understand the company’s language, facts, relationships, rules, history, and current operating state. It may use an ontology, knowledge graph, semantic layer, structured knowledge, retrieval and memory. These components work together to provide governed company context.
By Naman Kumar · Updated October 29, 2026
Short answer: build the smallest trustworthy context system that answers: what does this business term mean, which records are authoritative, how are entities related, what happened before, what is true now, who may see it, and where did the answer come from?
From implementation work
A blocked answer must stay blocked all the way to delivery.
In a local company-context implementation, review found a permissions check could block an alert while its status still said “delivered.” The repair kept the alert blocked and undelivered. Manual approval also stayed delivery-blocked when the destination could not receive the evidence. Approving a message could not widen its audience permissions.
The lesson: checking permissions during retrieval is only part of the job. The destination, publication step, and delivery status must enforce the same decision. Otherwise, the system can report success when it withheld the result.
Make that boundary part of agent permissions and approvals, then test the full delivery path, including denied access and misleading success states.
Vocabulary map
How do RAG, memory, ontologies and knowledge graphs differ?
| Term buyers use | What it does | Example | It is not |
|---|---|---|---|
| Ontology / business ontology | Defines the types of things, their meaning, and allowed relationships. | A “customer” may have accounts, contracts, sites, contacts, and service cases. | A document store. |
| Knowledge graph | Stores or exposes entities and their relationships so systems can traverse them. | Which facilities belong to this account, use this supplier, and have open incidents? | Automatically trustworthy because it is a graph. |
| Semantic layer | Standardizes business metrics and definitions across systems. | Every team calculates gross margin and active customer the same way. | Long-term conversational memory. |
| Structured knowledge layer | Makes important facts, rules, entities, and decisions machine-readable. | Approval thresholds, product rules, owners, and escalation routes. | A folder full of PDFs. |
| Retrieval / RAG / enterprise search | Finds source material relevant to the current question and gives it to the model. | Retrieve the current policy and matching contract terms. | A guarantee the source is current or applicable. |
| Enterprise or agent memory | Preserves useful state across turns, sessions, or workflow runs. | A supplier review remembers prior exceptions and unresolved commitments. | An excuse to retain everything forever. |
| AI-aware knowledge architecture | Designs sources, structure, provenance, access, freshness, and interfaces for both people and AI. | A governed context service serving several workflows. | A new system of record by default. |
Architecture test
What must company context tell an AI system?
Authority
Which system or owner is authoritative for this fact or decision?
Relationships
How do customers, products, contracts, locations, people, and work connect?
Time
What was true then, what is true now, and what changed?
Permission
Which people or agents may retrieve, infer, retain and act on the information?
Provenance
Can a reviewer trace an answer to its source, version, observation, or decision?
The seventh question is usefulness: does this context improve a real workflow? A knowledge graph is useful only if it helps the team complete a real task.
Governance questions
Who keeps company knowledge correct and current?
Can an owner correct a fact, relationship, or definition? Can the system distinguish an observation from a decision and a current state from a historical one? Does every retrieved claim preserve provenance and source permission? Are memory retention and deletion explicit? Can conflicting sources be surfaced rather than blended into a confident answer? Can teams see which applications and agents depend on a definition before it changes?
If those answers are missing, start with a narrower knowledge service for one workflow. Assess whether the service provides trustworthy, reusable business context and retrieves the evidence needed for the task.
Build sequence
How do you build a company brain around one workflow?
1. Choose a job
Start with a consequential, repeatable workflow: resolving a customer exception, reviewing a contract, qualifying an account, or preparing a management decision.
2. Trace its context
List the facts, documents, relationships, definitions, prior decisions, and current state needed for a correct answer. Mark authority and freshness.
3. Add structure selectively
Use retrieval for source material, structured fields for critical facts, an ontology where meaning is inconsistent, a graph where relationships matter, and memory only where continuity improves the work.
4. Govern and evaluate
Enforce source permissions, retention, citations, and review. Test stale, missing, conflicting, and unauthorized context alongside normal questions.
5. Reuse the stable parts
When definitions, connectors, entity mappings, and retrieval patterns prove useful, make them available to the next workflow.
6. Keep systems of record
The company brain should usually reference and interpret operational systems, not silently replace them. Writes need explicit authority and reconciliation.
OpenAI describes business context as connecting data warehouses, CRM tools, and internal apps so agents can build durable institutional memory. Its broader investment guidance also names trusted connectors and curated knowledge as shared capabilities. See OpenAI Frontier and AI investment guidance.
Decision boundary
Which context component should you build first?
| If the failure is… | Start with… |
|---|---|
| AI cannot find the right source | Source inventory, permissions, metadata, and retrieval. |
| Teams use the same word differently | Business definitions and a lightweight ontology or semantic layer. |
| Answers depend on connected entities | Stable identifiers and relationship modeling; consider a knowledge graph. |
| Work loses context between runs | Scoped workflow memory with retention and correction rules. |
| Sources conflict or change | Authority, provenance, timestamps, conflict policy, and human review. |
Related guides
Enterprise and regulated environments
A company brain must preserve data authority and policy.
| Required feature | Enterprise control | Required outcome |
|---|---|---|
| Classification and purpose binding | Label personal, confidential, privileged, regulated, and public data; record permitted purposes and prohibited uses. | Agents retrieve only context appropriate to the user, workflow, and approved purpose. |
| Lineage, provenance, and time | Preserve source, owner, version, effective date, observation time, transformations, and citations for material facts. | A reviewer can reproduce what the system knew and why an answer was considered valid at that time. |
| Permission-aware retrieval | Carry source-level identity and access controls through indexes, embeddings, caches, graphs, summaries, and memory. | The context layer never broadens access merely because information was transformed for AI. |
| Retention, deletion, and residency | Apply records schedules, legal holds, deletion requests, geographic restrictions, backup policy, and memory expiration. | Data does not become permanently retained or move jurisdictions simply because an agent used it. |
| Quality and conflict management | Name authoritative systems, validation rules, correction workflows, conflicting-source policy, freshness thresholds, and steward review. | Material decisions use current, attributable knowledge; uncertainty and disagreement remain visible. |
| Isolation and leakage testing | Separate tenants and environments; test prompt injection, unauthorized retrieval, inference leakage, export, and bulk extraction. | Sensitive context cannot cross customers, roles, cases, or approved workflow boundaries. |
For regulated work, the desired result is not “the agent knows everything.” It is the right agent receives the minimum correct, current, and authorized context with supporting evidence. Sector rules may also require specialized consent, recordkeeping, data-subject, confidentiality, or validation controls.
These controls support the lifecycle risk approach in the NIST AI RMF and the traceability, transparency, and continual-improvement objectives described by ISO/IEC 42001.
Keeping context attached to the work
The agent coordination case study describes shared project context, persistent decisions and version-bound checks. It shows why storing knowledge and knowing whether a completion claim is still current are separate requirements.
Inspect a scoped-retrieval evaluation
The agent-coordination case includes a three-size retrieval check, the Python runner and its dated results. It measures returned context and checks that the relevant completed work and evidence remain available.