What Thinking Surface is

Why we built it

Every general-purpose assistant now has some form of memory. Turn it on and it will remember what your company does, that you prefer short answers, that your operations manager is called Dana. It is genuinely useful, and it did not solve the problem we had.

The problem, in the words it was first said out loud:

Even with memory on, I don’t feel like I’m making real progress.

That sentence is worth sitting with, because it rules out the obvious diagnosis. The complaint is not that the model forgot. Recall was never the scarce thing. What was missing was compounding: the property that Tuesday’s conversation stands on what was settled on Monday, that a second person’s conversation stands on both, and that an automation running at three in the morning stands on all three.

Assistant memory cannot have that property, for three structural reasons rather than any failure of engineering. It is per-user: your assistant’s memory is yours, not your operations manager’s. It is vendor-scoped: move to a different assistant and you begin again. And it is a store rather than a structure: it can hand back what you said, but it cannot tell you what already governs the question you are asking, who has the standing to settle it, or what settling it would cost. There is nothing in it to think inside, only something to be reminded of.

That third gap is the one the product is built into. A Surface gives the thinking a shape: what has already been ruled on in this area, who may rule on it, what a commitment would displace, what is still only proposed. The assistant navigates by that shape instead of by recall. The same shape is what makes recording cheap: when something does settle, there is a specific place for it to go.

The shape is deliberately loose, because deciding is not a linear process. Most of a real working conversation is rabbit trails: the tangent that turns out to matter, the half-formed thought you would not defend yet. So trying things stays free: what-ifs are computed and thrown away, and only what you confirm becomes record.

A session that settles nothing is not a failed session. It is the normal case, and the record is built to survive it.

A second observation shaped the design more than the first. Once a record is shared, the question of who may write to it stops being an access-control detail and becomes an org chart. In most software the org chart lives in a permissions screen while the real authority, who can commit the company to a price or approve a client’s terms, lives in people’s heads. We put authority in the record layer, as data, on the same footing as the records it governs.

What a Surface is

A Surface is shared, permissioned context: for a business, one team inside it, a department, one person’s own read on their company, a household. You decide how tight or wide it is, and you do not need anyone’s permission to make one.

Exploring it is safe, which is the part that separates it from assistant memory. Nothing is written because a model judged it worth remembering: what-ifs are computed and thrown away, and a thought you are not ready to stand behind goes to an inbox rather than into the record. Nor is there filing to do as you go. The offer to keep something comes when it settles, which in a long session usually means near the end, and what it keeps lands as a proposal rather than as policy. You can think freely without quietly steering what the business believes.

How many you want is a judgment call, and the answer is usually fewer than people expect. Separation inside a Surface already comes two ways: scopes organise it by client, department, or product line, and audience restricts it, enforced in the database. Reach for a second Surface only when something must not share a tenant at all: different books, or a read of the business that is genuinely yours rather than the company’s. Splitting is a wall, not a filter, because no search spans Surfaces.

It is a connector, not an application. There is no dashboard and no second place to keep current. You add it to Claude, ChatGPT, or Grok the way you would add any other connector, and from then on the assistant you already talk to knows what everyone sharing it knows.

A Surface holds five kinds of thing:

Decisions

What was settled, by whom, under what authority, and what it displaced: the capacity spent, the cash committed, the option foreclosed. Also what a decision replaced when it superseded one, and what is still only proposed.

Commitments

What you have promised, to whom, due when, drawing on whose capacity.

People

Who knows what, who introduced whom, what was said and when.

Knowledge

The rules, the exceptions, the things that never had a field to live in.

Numbers

Assumptions carrying their provenance and an as-of date, and a model to run them through. Committed versions are kept and can be set side by side; the what-if layer on top of them is deliberately thrown away.

It is not where all your data lives, and it is not trying to be. Your assistant can hold many connectors at once, and it should: your books, your bank, your email, your calendar, whatever system actually runs your operation. Each of those answers the question it was built for, which is what is true right now, and a Surface holds none of it. No balances, no invoice status, no inventory counts. It links to the record in the system that owns it and never copies the value across, so there is no cache here to go stale and no second number to reconcile.

Three different things are in play when you are working something out, and it is worth being clear that they are not the same thing:

• your assistant’s memory knows you: how you work, what you have told it
• your connected systems know what is true right now
• a Surface knows what has been settled, promised, ruled out, and learned

The model composes all three live, at the moment you ask. That is the whole architecture, and the reason we do not ingest the others: a copy is always a little out of date, and the moment there are two numbers for the same thing you have a reconciliation problem instead of an answer. So this is not a replacement for the tools you already run, and not a replacement for your assistant’s memory either. It is the third input, the one that usually never gets written down anywhere.

It replaces nothing. It holds the part nothing else keeps.

How it works

The connection

The product is a remote MCP server, which is the thing your assistant already knows how to connect to. You sign in the way you would for any other connector, and that sign-in binds to exactly one Surface. That constraint is load-bearing rather than incidental: it is what makes “this conversation is about this Surface” a fact the server knows rather than something a model has to be trusted to keep straight.

To point an existing connection somewhere else, start Reconnect or Reauthorize in your assistant and choose the new Surface during sign-in. The completed flow gives the client a fresh credential; an already-issued credential never changes which Surface it can reach.

Automations and scripts use a key instead of signing in. A key belongs to a person and is held to exactly the same limits they are, so it is never a way around the rules.

The record

Underneath it is a graph: things, and the links between them. A link can end without being erased, so “they used to work there” stays true instead of disappearing. Every change keeps the version before it, so nothing is quietly overwritten.

Two attributes do most of the organizing work. Every entity carries scopes (client/acme, dept/production, pricing/floor), so “everything about this client” is a structural query rather than a search guess. And every entity carries an audience, which is how a founder’s “don’t share this one” stays with the founders through every tool, workflow, and triage step, because the constraint is on the row and not on a screen.

Permission, and where it is enforced

This is the part worth being precise about, because most products answer it differently than they appear to. The request path runs the database as the person making the request, not as a service account with a filter applied afterwards.

AI client
  │
  └─ connector sign-in ──────► one Surface, one member
       │
       └─ the person who signed in
            │
            └─ the database, acting AS THAT PERSON
                 │
                 └─ only the rows they may see

Every permission question routes through one check, and that check lives in the database rather than in the application. The practical consequence: if the tool layer had a bug tomorrow, a missing check or a mis-wired filter, the database would still refuse the read. Permission is a floor, not a wrapper.

Access is a role crossed with a domain. Roles are owner, admin, member, and viewer. Domains are the five kinds of thing a Surface holds, plus an inbox for untriaged captures and a capacity domain deliberately split out from finance, so whoever actually knows what the team can take on can record commitments without also seeing cash, revenue, and deals.

Defaults. Domains are held per member, so a bookkeeper can be given finance and nothing else.

Ratification

A decision enters the record as a proposal. It becomes binding when someone with the authority to do so ratifies it. That authority is a third verb alongside read and write, and it is seeded to owners only, not to admins, which is a distinction most permission models collapse and this one keeps.

Owners delegate it by scope. A grant binds a person to a scope pattern: the account manager who runs client/acme can ratify decisions scoped to that client, and only that client, without becoming a co-owner and without gaining sight of the books. A decision must match every one of its scopes against a grant to qualify, and a decision carrying no scopes at all stays owner-only. A grant that matches everything is the thing the design exists to avoid.

The gate is enforced in three independent places, the deepest of them inside the database where even a privileged write cannot get around it. The redundancy is deliberate: two of the three exist to defend against our own future mistakes.

Capture

The failure mode of every shared record is that nobody maintains it. We treat that as the primary product risk rather than a support problem, and the whole mechanism follows from it: capture happens inside the conversation you were already having, at the moment something settles, in one sentence.

The server instructs every connected model to route by kind. A settled rule becomes a decision proposal. A fact about a person goes to the people tools. A figure goes to the financial model along with where it came from. A half-formed thought goes straight to the inbox without stopping to ask, precisely because the inbox is not the record: it is triaged later rather than promoted now, and the triage step never merges on its own. It proposes.

Capture is cheap. Record is never assumed.

Nothing becomes record because a model judged it important. This is also the only honest thing to say about the loop the product depends on: unsettled talk becomes “what happened last time” only if you say yes.

Computation

Thinking Surface contains no solver, and that is a decision rather than a gap. When you ask what has to not happen if you take a job at a given price, the answer is computed deterministically, in ordinary code, with no model in the loop, against the commitments you have actually declared. The model asks the question, presents the result, and records what you confirm. It is the interface to the calculator, never the calculator.

Asking is deliberately cheap. A what-if is an ephemeral layer over a stored version, never persisted, never versioned, never something you have to clean up, so there is no cost to trying the tenth variation, and no quiet penalty for exploring a direction you abandon. Committing is the separate, deliberate act, and only the committed versions are kept and comparable.

One consequence is worth stating because it shows the posture. Capacity ceilings live on the finance-gated financial model, but the simulation is a capacity-domain tool, so a production lead with capacity access and no finance access reads zero rows for the ceiling. Rather than returning a confident “it fits,” the answer comes back explicitly marked as unknown, naming what it could not see, and the tool is instructed not to soften it. A tool that guesses quietly is worse than one that says it cannot see.

Things we decided not to build

An interface

There is a sign-in page, a place to create a Surface, members, and keys. That is the whole application. Anything more would be a worse version of the conversation you are already in, and it would compete with the record for your attention.

Cross-Surface search

One grant, one Surface, no query that spans them. It costs convenience for anyone holding more than one. It buys a boundary we can describe in one sentence and never have to qualify.

Learning across customers

No aggregation, no cross-tenant training, no “businesses like yours also.” These records are identity-dense and small-n; they cannot be honestly de-identified. Anything collective here will be authored rather than extracted.

Ingestion

No warehouse, no sync, no nightly copy of your other systems. Reasoning over a copy means answering from data that was true earlier, and the staleness is invisible at the point it does damage. Composing live at the moment of the question costs a round trip and is worth it.

What it does not do yet

The product is in invite-only beta. These are real gaps, not roadmap language.

• No SSO or SAML, and no audit log. It should not be evaluated as enterprise-ready, because it is not.
• Nothing pushes. There are no notifications and no digests; what is waiting for you (proposals you can ratify, overdue follow-ups, commitments assigned to you) appears when a session opens, not before.
• Team invitations depend on outbound email we have not finished wiring. Until that lands, adding a teammate carries an asterisk.
• One Surface per connector grant. The binding itself is deliberate. Switching uses the client’s Reconnect or Reauthorize flow, because only the client can safely replace its credential; the server cannot switch a live connection in place.
• Export covers decisions and entries as deterministic, paginated dumps. It is not yet a complete backup of everything a Surface holds.
• There is no published price. Beta is invite-only.

Questions

Select a question to open it.