artificial intelligence (AI) and security
Shared memory and security
A design for one governed memory that Microsoft Copilot, Claude, ChatGPT Enterprise, Gemini Enterprise, and self-hosted models can all use. Each client's knowledge stays apart. A broker checks every read and write, and every change leaves a record.
Design proposalVersion 2.0, draft24 October 2026
- 5kinds of AI platform it serves
- 1memory broker that checks every read and write
- 10security controls
- 4levels of classification
- 20weeks from discovery to a running service
Where the idea comes from
I already work this way on my own. Before each task, Claude reads a folder of my rules, ways of working, and decisions. So it does not repeat a mistake, and an idea I rejected stays rejected.
That works for one person. A firm with many clients and several AI tools needs more. Copilot, Claude, ChatGPT, and Gemini each keep their own memory, and none of them knows which client a fact belongs to. This design turns a personal memory folder into a service a whole organisation can trust.
Who each part is for
The design has eight audiences. Each one can start with the part written for them. The glossary near the end explains every term.
| Audience | Start with | What they decide |
|---|---|---|
| Board, executives, and sponsors | Executive summary | Whether to fund the pilot |
| Finance and procurement | Business case, and costs | The budget and the licences |
| Investors | Business case, and costs | Whether the model can grow into a service |
| Architects and technical teams | Architecture | Which platforms and storage to connect |
| Security teams | Security | Which controls must be in place before go-live |
| Governance teams | Governance | The policies and the review cycle |
| Project managers | Delivery, and the operating model | The plan, the milestones, and who does what |
| Research and strategy teams | Research data and the research hub | Which findings reach a client, and when recordings are disposed of |
Executive summary
Vision
One memory for the organisation that works with any approved AI model. AI tools work the same way on every engagement, and no client's knowledge leaks into another client's work.
Benefits
- Less repeated work. Teams write a standard, template, or decision once, and every AI tool reads it.
- The same answer from every tool. Copilot and Claude read the same approved rules.
- Faster starts. New staff and new AI sessions pick up the client's history on day one.
- Knowledge that stays. When people move on, their decisions stay in the memory.
Business drivers
Most organisations now pay for more than one AI tool. Each tool keeps its own memory, so staff repeat the same context in every chat. Client work also brings duties of confidentiality that a chat history cannot prove.
Strategic alignment
The design keeps the organisation free to change AI supplier. The memory lives in storage the organisation already owns, in plain files, so no model or vendor holds it.
Recommendations
- Start with Microsoft 365, Copilot, and SharePoint, because most firms already pay for them.
- Run a pilot with two or three clients, and pass a security review before go-live.
- Add Claude, ChatGPT, Gemini, and self-hosted models once the broker and audit work.
Business case
Current challenges
- Staff paste the same background into every chat, in every tool.
- Each tool remembers different things, so answers drift apart.
- Nobody can show which AI tool read which client's files, or when.
- Knowledge leaves with the people who hold it.
Opportunities
The organisation already owns the storage and many of the licences. The new part is the broker, the folder standard, and the governance around them.
Expected benefits
Less time spent prompting, faster onboarding of staff and clients, consistent work across teams, and a record that answers an auditor's questions.
Return on investment
Time saved drives the return. Fifty people who each save two hours a week free up about 4,600 hours a year. Try your own figures in the calculator under Commercial.
Implementation costs
A team that builds it in-house might spend £5,000 to £20,000. A consultancy build might cost £25,000 to £100,000 or more. Running costs depend on size, from about £3,000 to £100,000 a year.
Risk reduction
Today, a misfiled document or a careless prompt can put one client's facts in front of another. The broker blocks that, and the audit log proves it.
Architecture
Logical architecture
Five layers. People use the AI tools they already have. Every tool reaches the memory through the broker, never directly.
The memory broker
The broker is a small service between the AI tools and the files. It has six jobs.
- Session isolation. Each session opens one client, and only that client.
- Permission validation. It checks the person's own rights before the AI reads anything.
- Classification validation. It compares the file's label with what the session may handle.
- Secret detection. It scans every write for passwords, keys, and card numbers, and stops the write if it finds one.
- Policy enforcement. It applies the governance policies, such as which models may write.
- Audit management. It logs every request, allowed or blocked.
Physical architecture
The storage abstraction layer lets the same memory sit in different places. The organisation picks the storage it already trusts.
Two Microsoft tools appear often from here on. Purview labels and protects data. Entra ID is Microsoft's sign-in and identity service, which controls who can open what.
- Microsoft 365The platform for SharePoint and OneDrive, with Purview and Entra ID controls.
- SharePointThe main repository for most firms. One site, one library for each client.
- OneDrivePersonal working memory that a person can promote to a client folder.
- Google DriveThe repository for firms that run on Google Workspace with Gemini.
- Self-hosted storageA network-attached storage (NAS) box, a Linux file system, Windows shares, or a Git repository.
- Hybrid storageSharePoint for most clients, and a private vault for the most sensitive ones.
The repository
Every deployment uses the same folder standard. Folders that start with an underscore belong to the whole organisation. Each client gets its own folder, built from a template.
- memory/
- _global/Shared by every client
- templates/
- policies/
- standards/
- _audit/Written by the broker only
- movement-logs/
- access-logs/
- change-logs/
- _templates/Copied when a client joins
- client-templates/
- metadata-templates/
- clients/One folder each, never shared
- client-a/
- research/
- client-b/
- client-c/
- client-a/
- archive/Read only, kept until the retention date
- retired-clients/
- _global/Shared by every client
AI platforms
The design works with any approved model. Copilot reads only, through Microsoft's own controls. The others can write, but only through the broker. The research hub and its workflow orchestrator are two more clients of the same broker.
One of Microsoft's controls is data loss prevention (DLP). DLP rules stop labelled data leaving the organisation, for example in an email or a chat.
| Platform | Type | Access | Controls |
|---|---|---|---|
| Microsoft Copilot | Enterprise AI | Reads client memory and global memory | Purview, Entra ID, and DLP |
| Claude | Enterprise AI | Reads, and writes through the broker | Broker checks and audit |
| ChatGPT Enterprise | Enterprise AI | Reads, and writes through the broker | Broker checks and audit |
| Gemini Enterprise | Enterprise AI | Reads, and writes through the broker | Broker checks and audit |
| Self-hosted models | Llama, Phi, DeepSeek, or Mistral | Set for each deployment. The only models that may read Restricted data, such as raw interview recordings | Broker checks, and no data leaves the building |
| Research hub | Internal web app | Reads, and writes approved findings through the broker | Single sign-on, roles, broker checks, and audit |
| Workflow orchestrator | Self-hosted n8n | Writes drafts only. It cannot approve, publish, or send | Broker checks, content scanning, and spend limits |
Deployment models
Four ways to run it. The broker and the folder standard stay the same in every one.
- Microsoft 365Microsoft Copilot, SharePoint, OneDrive, Purview, Entra ID, and Power Automate.Best first step for most firms
- Google WorkspaceGoogle Drive and Gemini Enterprise.For firms that run on Google
- Self-hostedA NAS, a Linux file system, Windows shares, or a Git repository, with local models.For regulated or offline work
- HybridSharePoint, a private vault, a NAS, and an enterprise AI layer.When a few clients need more protection
Security
Threat model
The design plans for seven threats. Each one has at least two controls against it.
| Threat | What could happen | Main controls |
|---|---|---|
| Accidental data leakage | One client's facts appear in another client's work | Session isolation, classification, and DLP |
| Misconfigured permissions | A folder opens to people who should not have it | Access reviews, and the broker's permission check |
| Compromised accounts | An attacker signs in as a member of staff | Audit logging, encryption, and access reviews |
| Improper client access | Someone opens a client they do not work on | Session isolation, and the permission check |
| Third-party model risk | A model or connector keeps or misuses data | Classification, secret scanning, and the cross-model policy |
| Prompt injection | A review, ticket, or web page holds hidden instructions, and an AI follows them | Content scanning, no tool access for imported text, and human approval |
| Unchecked AI output | A wrong or invented finding reaches a client | Human approval, evidence links, and the two-source rule |
Controls
- Session isolation: one client for each session.
- Audit logging: a record of every read, write, move, and block.
- Classification: a label on every file.
- Secret scanning: no passwords, keys, or card numbers in memory.
- Data loss prevention (DLP): rules that stop labelled data leaving the organisation.
- Encryption: files encrypted in storage and in transit.
- Access reviews: every quarter, an owner confirms who still needs access.
- Content scanning: imported text is data, never instructions, and it can never call a tool.
- Human approval: no AI draft leaves the organisation until a named person approves it.
- Spend limits: each client and project has a limit on AI costs, with an alert before it is reached.
Classification
Every file carries one of four labels. The higher the label, the fewer tools may read it.
- PublicSafe to publish. Any approved tool may read it.
- InternalFor staff only. Any approved enterprise tool may read it.
- ConfidentialClient work. Only tools inside the client's session may read it.
- RestrictedThe most sensitive client data. Self-hosted or private vault only, and a person approves each use.
Governance
Policies
- Client isolation. No session reads two clients at once.
- Cross-model access. Which models may read and write, and at which classification.
- Access review. Who reviews access, and how often.
- Retention. How long the archive keeps a client, and how it disposes of them.
- Classification. Who sets a label, and who may change it.
- Audit. What the log records, and who reads it.
- Research data. Which label each kind of research data gets, and when raw recordings are disposed of.
- Human approval. Which AI outputs need a named person before they leave the organisation.
Review cycle
- Every monthAudit review, including the rejection reasons from decision reports
- Every quarterAccess review and permission audit
- Every yearArchitecture review
Operating model
Onboarding a client
Power Automate runs the steps after approval. A person approves before anything gets built.
- Request
A project lead asks for a new client memory.
- Approval
The security lead approves, and sets the classification.
- Create folders
The flow copies the client template, including its research folders.
- Apply permissions
Only the client team gets access.
- Generate templates
Metadata and starter files for the client.
- Register audit entry
The audit log records the new client.
- Go live
The AI tools can now open the client's session.
Offboarding a client
Offboarding never deletes on the day. The archive keeps the client until the retention date, then disposes of it.
- Client closure
The engagement ends.
- Remove access
The team, the AI tools, and the research workflows lose access first.
- Create archive
A read-only snapshot of the client folder.
- Apply retention
The retention policy sets the disposal date.
- Archive client
The folder moves to the archive.
- Dispose at expiry
A person confirms, then the files go for good.
Who does what
A responsible, accountable, consulted, and informed (RACI) matrix shows each role's part in each activity. R means responsible, A accountable, C consulted, and I informed.
| Activity | Executive sponsor | Solution architect | Security lead | AI platform lead | Microsoft 365 administrator | Operations lead |
|---|---|---|---|---|---|---|
| Architecture | A | R | C | C | C | I |
| Governance | A | C | R | C | I | C |
| Security | I | C | A and R | C | C | I |
| Implementation | A | C | C | R | R | C |
| Support | I | I | C | C | C | A and R |
| Audit | I | I | A | C | R | C |
Delivery
Five phases over 20 weeks. The pilot proves the broker with real client folders before the full rollout.
- Discovery Weeks 1 to 2
- Architecture Weeks 3 to 6
- Pilot Weeks 7 to 10
- Implementation Weeks 11 to 16
- Optimisation Weeks 17 to 20
Milestones
- Architecture approved at the end of week 6.
- Pilot completed at the end of week 10.
- Research hub connected to the broker during the pilot, in weeks 7 to 10.
- Security review passed before the rollout goes beyond the pilot clients, and before any client sees a dashboard.
- Go live at the end of week 16.
- Operational handover to the operations lead at the end of week 20.
Research data and the research hub
The research workflows and research hub use this memory for every piece of research. The hub reads and writes through the same broker, with the same four checks, the same labels, and the same audit log. So a finding has the same protection as any other memory entry.
Research brings one kind of data the rest of the memory does not: recordings of real people. Raw recordings are Restricted, so only a self-hosted model may transcribe them. Once personal data is removed, the transcript becomes Confidential client work.
| Research data | Folder | Label | Kept until |
|---|---|---|---|
| Interview recordings and raw survey exports | clients/client-a/research/recordings | Restricted | 90 days after transcription, unless the consent form says otherwise |
| Transcripts with personal data removed | clients/client-a/research/transcripts | Confidential | The client's retention date |
| AI drafts waiting for review | clients/client-a/research/drafts | Confidential | 30 days after the decision |
| Approved findings | clients/client-a/research/findings | Confidential | The client's retention date |
| Reports and dashboards for the client | clients/client-a/research/reports | Confidential | The client's retention date |
| The research codebook, prompts, and report templates | _global/standards and _global/templates | Internal | Kept, with every version |
| Who approved or rejected each draft, and why | _audit/change-logs | Internal | The audit retention date |
- Drafts are not findingsThe workflow orchestrator writes drafts only. A finding exists only after a named person approves it.Human approval
- Two sources or it is not a findingEach finding links to its evidence, and needs at least two sources.Memory entry
- Imported text is dataReviews, tickets, and web pages are scanned for instructions, and can never call a tool.Content scanning
- Every decision is recordedEach approval and rejection is an audit record, and the decision report shows them at a glance.Audit
Commercial
Cost models
Planning estimates of the yearly running cost, at three sizes. They exclude AI licences, which the organisation pays for each user.
- £3,000Starter: one team, Microsoft 365 or Google Workspace, one storage option
- £20,000Professional: several AI platforms and hybrid storage
- £100,000Enterprise: self-hosted models, regulated clients, and full audit support
Licensing
Every AI platform here charges for each user. Prices checked on 24 October 2026, before value added tax (VAT), for each user each month on an annual plan.
| Licence | Price for each user each month | Notes |
|---|---|---|
| Microsoft 365 Business Premium | About £17.60 | The base licence that Copilot needs |
| Microsoft 365 Copilot | £16.10 to £23.10 | An add-on. The lower price is the Business plan for smaller firms. |
| Claude Team | About £15 | Standard seat. At least two seats. Charged in US dollars, so the price in pounds changes with the exchange rate. |
| ChatGPT Business | About £15 | At least two seats. Charged in US dollars, so the price in pounds changes with the exchange rate. |
| Google Workspace Business Standard | £11.80 | Gemini included |
Prices change often. Claude and ChatGPT prices are converted from 20 US dollars at the rate on 27 October 2026, when one dollar was worth about 75p. Check them with the supplier before you set a budget.
Build it yourself, or use a consultancy
| Area | Build it yourself | Consultancy |
|---|---|---|
| Upfront cost | £5,000 to £20,000 | £25,000 to £100,000 or more |
| Speed | Slower | Faster |
| Expertise | Your own team | Specialists |
| Risk | Higher | Lower |
| Documentation | You write it | Provided |
| Support | Your own team | Managed |
Return and total cost calculator
Enter your own figures. The calculator works out the yearly value of the time saved, the total cost of ownership (TCO), and the return on investment (ROI).
Glossary
The terms on this page, in alphabetical order.
- Access review
- A regular check, every quarter, where a folder owner confirms who still needs access.
- Archive
- The read-only folder that keeps a former client's memory until its retention date.
- Audit log
- The record of every request to the memory: who asked, from which tool, for what, and whether the broker allowed it.
- Classification
- The label on every file: Public, Internal, Confidential, or Restricted. It decides which tools may read the file.
- Client isolation
- The rule that keeps each client's memory apart, so no session reads two clients.
- Confidential
- Client work. Only tools inside that client's session may read it.
- Connector
- The link that lets an AI tool read from or write to a system, such as SharePoint.
- Content scanning
- A check on imported text, such as reviews and web pages, for instructions aimed at an AI. Imported text is data, never instructions.
- Data loss prevention (DLP)
- Rules that stop labelled data leaving the organisation, for example in an email, a chat, or an upload.
- Decision report
- A one-page summary of a review: what the AI drafted, what a person accepted, edited, or rejected, the evidence, and the safeguards that ran.
- Encryption
- Scrambling data so only people with the right key can read it. The design encrypts files in storage and while they move.
- Entra ID
- Microsoft's sign-in and identity service. It controls who can open what.
- Finding
- A memory entry from research, approved by a person, with links to at least two sources.
- Global memory
- The templates, policies, and standards in the _global folder, which every client shares.
- Hybrid deployment
- Running the memory in more than one place, such as SharePoint for most clients and a private vault for the most sensitive.
- Internal
- For staff only. Any approved enterprise AI tool may read it.
- JavaScript Object Notation (JSON)
- A plain text format for structured data, which people and software can both read.
- Memory broker
- The service between the AI tools and the files. It checks every read and write, and logs each one.
- Memory entry
- One fact, rule, or decision stored in the memory, with its client, label, source, and owner.
- Memory repository
- The set of folders that holds the memory, whichever storage it sits in.
- Network-attached storage (NAS)
- A storage box on the organisation's own network.
- Orchestrator
- The tool that runs the research workflows, such as a self-hosted n8n. It writes drafts only.
- OneDrive
- Microsoft's storage for each person's own files.
- Power Automate
- Microsoft's tool for automatic steps, such as building a client's folders after approval.
- Prompt injection
- Hidden instructions in content an AI reads, written to make it do something it should not.
- Public
- Information that is safe to publish. Any approved tool may read it.
- Purview
- Microsoft's tool for labelling and protecting data.
- Research hub
- The web app the research team uses to start projects, review AI drafts, and search past research. It reaches the memory only through the broker.
- Responsible, accountable, consulted, and informed (RACI) matrix
- A table that shows each role's part in each activity.
- Restricted
- The most sensitive client data. Only self-hosted models or a private vault may hold it, and a person approves each use.
- Retention
- How long the organisation keeps a client's memory after the work ends, before it disposes of it.
- Return on investment (ROI)
- The value a project gives back, compared with what it costs, shown as a percentage.
- Secret scanning
- A check on every write for passwords, keys, and card numbers. The broker stops the write if it finds one.
- Self-hosted model
- An AI model that runs on the organisation's own computers, such as Llama, Phi, DeepSeek, or Mistral.
- Session
- One working conversation with an AI tool. In this design, each session opens one client only.
- Spend limit
- The most a client or project may spend on AI in a month. A run pauses and alerts a person before it passes the limit.
- SharePoint
- Microsoft's service for shared team sites and document libraries.
- Storage abstraction layer
- The part of the design that lets the same memory sit in SharePoint, Google Drive, or self-hosted storage.
- Total cost of ownership (TCO)
- Everything the platform costs over a period, including setup, licences, and running costs.
- Value added tax (VAT)
- The tax added to the price of most goods and services in the United Kingdom.
Appendices
Open each appendix to read it.
Appendix A: Folder structure
The standard has five top-level folders. The repository diagram under Architecture shows them in full.
- _global: templates, policies, and standards that apply to every client.
- _audit: movement, access, and change logs. Only the broker writes here.
- _templates: the client template and the metadata template.
- clients: one folder for each active client, with a research folder for recordings, transcripts, drafts, findings, and reports.
- archive: retired clients, read only, until their retention date.
Appendix B: Memory schema in JavaScript Object Notation (JSON)
Each memory entry is a small JSON record. The broker refuses an entry with a missing field.
{
"id": "client-a/decisions/0042",
"client": "client-a",
"type": "decision",
"classification": "Confidential",
"summary": "Use plain British English in all client reports.",
"source": "Project kick-off notes, 14 October 2026",
"createdBy": "project-lead",
"createdWith": "Claude",
"approvedBy": "client-owner",
"created": "2026-10-14",
"reviewBy": "2027-04-14"
}A finding from research uses the same record, with two more fields: the evidence it links to, and the confidence the workflow gave it.
{
"id": "client-a/research/findings/0107",
"client": "client-a",
"type": "finding",
"classification": "Confidential",
"summary": "Shoppers find the delivery cost only at checkout.",
"source": "Interview synthesis, 27 October 2026",
"evidence": ["transcripts/int-02#14m", "transcripts/int-05#22m"],
"confidence": 92,
"createdBy": "orchestrator",
"createdWith": "Claude",
"approvedBy": "researcher-04",
"created": "2026-10-27",
"reviewBy": "2027-04-27"
}Appendix C: Audit schema
The broker writes one audit record for every request, whatever the outcome.
{
"time": "2026-10-24T09:12:07Z",
"session": "s-7f3a",
"person": "analyst-12",
"platform": "Copilot",
"client": "client-b",
"action": "read",
"path": "clients/client-b/standards/style.md",
"classification": "Internal",
"result": "allowed",
"checks": ["session", "permission", "classification"]
}Appendix D: Risk register
| Risk | Likelihood | Impact | How the design reduces it |
|---|---|---|---|
| Client data leaks between clients | Medium | High | Session isolation, and one folder for each client |
| Governance stops happening | Medium | Medium | A fixed review cycle with named owners |
| Gaps in the audit record | Low | High | Only the broker writes the log, and it logs blocks too |
| Prompt injection through imported content | Medium | High | Content scanning, no tool access for imported text, and human approval |
| A wrong AI finding reaches a client | Medium | High | Human approval, evidence links, and the two-source rule |
| Too many people have access | Medium | High | Quarterly access reviews and a permission audit |
| Staff use unapproved AI tools | High | Medium | A cross-model policy, DLP, and approved tools that are better to use |
Appendix E: Power Automate flows
- Client onboarding: runs after approval. It copies the template, sets permissions, and registers the audit entry.
- Client offboarding: removes access, creates the archive, and sets the retention date.
- Monthly audit pack: collects the month's blocked requests and unusual access for the audit review.
- Access review reminder: asks each folder owner every quarter to confirm who still needs access.
- Secret alert: tells the security lead when the broker stops a write that holds a secret.
- Recording disposal: lists raw recordings 90 days after transcription. A person confirms, then they go for good.
Appendix F: Open memory protocol alignment
The memory lives in plain files with an open schema, so no vendor owns it. As open standards for AI memory settle, the schema can follow them without moving the files.
The broker already speaks to each platform through a connector. A shared protocol would replace several connectors with one.
Safeguards
These are the memory’s own safeguards. The safeguards every AI workflow follows are listed in full on the Workflows page.
- No direct access. AI tools reach the memory only through the broker.
- One client at a time. A session cannot read two clients.
- No secrets in memory. The broker stops any write that holds a password, key, or card number.
- A person approves. New clients, Restricted data, and disposal all wait for a named person.
- Nothing disappears on the day. Offboarding archives first and disposes only at the retention date.
- Everything leaves a record. Blocked requests go in the audit log too.
- Imported text is data. Content an AI reads can never give it instructions or call a tool.
- No AI draft leaves without a person. Research findings and reports wait for a named reviewer.
Take it to the next level
- Run a red-team test, where testers try to make one client's session read another client's files.
- Add a dashboard of blocked requests, so the monthly audit review starts from the data.
- Let people correct a memory entry from inside the AI tool, with the change sent for approval.
- Offer it as a managed service, with hosting and consulting for firms that cannot build it themselves.