One Turn, Many Boundaries: How QM Resolves Context
QM's central scope model becomes operational when a request arrives. This chapter follows how QM turns a conversation, its actor, and its full audience into a temporary view of workspace, policy, memory, files, skills, and delivery. The practical value is a way to predict two things before an agent acts: which context is writable, and which resources are merely visible for this turn rather than becoming a reusable capability.
From conversation kind to target scope
A request does not enter QM as an abstract prompt. It arrives through a surface with an actor, a conversation, and an audience. The conversation kind provides the first boundary. A direct message maps to a personal scope for the actor. A group conversation maps to a group scope. A channel or thread maps to a channel scope. These distinctions matter because they determine where ordinary work belongs. A response in a project channel should not silently write into one participant's private workspace simply because that person happened to initiate the request.
The resolver then builds layers around that target. The organization scope is mounted read-only as a global layer. The current conversation scope is the writable layer. In a direct message, the actor's team scopes may be mounted read-only as additional layers. The arrangement is deliberately asymmetric: organization-wide instructions and shared material can inform local work, while the conversation's work can change without rewriting the organization's common base. A private turn can also receive team context without gaining permission to edit it.
This is a useful distinction between where the agent is working and what the agent is allowed to consult. The writable scope is the home of the turn's local changes. Read-only layers are context supplied from elsewhere. A layer is not automatically a license to perform every operation associated with its owner. It is a bounded way to expose state while preserving ownership.
The resolver also brings policy into the same calculation. It refreshes security configuration for relevant scopes, composes organization and lower-scope command policies, resolves security and sharing posture, and computes audience-dependent egress and access handles. In other words, the target scope is not selected once and then forgotten. The current audience and the current configuration affect the view that follows.
That recalculation is what keeps the scope model attached to the present rather than to a stale conversation label. A team membership can change. A room can tighten its sharing posture. An administrator can change the organization's policy floor. The resolver does not need to rewrite the conversation's history to reflect those changes; it can construct the next turn from the current actor, audience, configuration, and scope relationships. The trade-off is that authorization is a live dependency. A turn may be refused or receive less context after a membership or policy change, even when the conversation itself still exists.
The read-only organization layer is also more than a convenient place for common instructions. It establishes a direction of authority. Organization-level context can constrain or guide a lower scope, while a local conversation can add work-specific context without silently overriding the organization policy. Team layers in a direct message serve a narrower role: they can supply relevant shared context, but they do not make the private conversation the owner of team state. This is why the same physical person can participate in several scopes without making those scopes interchangeable.
Consider a channel with three participants. One person may own a file and another may own a service credential, but the agent is answering the channel rather than a private message. If the sender's entitlement were enough, the agent could disclose one participant's resource to the others merely because the sender asked. QM instead evaluates the audience as a group. The relevant question is not only “can the requester reach this?” but also “can every person who may receive the result be entitled to it under this conversation's scope?”
That audience-wide reasoning also explains why delivery belongs in resolution. A turn is not complete when the model produces text. QM must know where the result will be sent and which scope's rules govern that delivery. The same request might be acceptable in a private conversation but require different resource handling in a shared room. The core therefore prepares identity, scope, policy, and delivery as one authorization context before handing the work to the harness.
This prevents a common category error: treating access to input as if it were permission to publish the output anywhere. Reading a document in a private turn and quoting it into a channel are different effects. The first concerns the actor's access to the source; the second concerns the audience that will receive the result. By keeping delivery in the resolved context, QM gives the system a place to account for that second step, even though the model can still make a poor disclosure decision after authorization.
The sequence is important because it puts audience and policy before the agent loop. The harness does not begin by deciding whose files to search. It receives a context that the core has already shaped. That does not make the model infallible, but it moves the primary authorization decision to a component designed to hold identity, scope, and policy together.
The turn-local view: context without borrowed authority
Once the target scope and audience are known, QM builds a turn-local context. The implementation describes this as a view, not a reusable capability or a cross-turn cache. That wording captures a major design choice. A resource may be made visible because it is relevant and authorized now, without granting the agent a permanent right to carry that visibility into a different conversation.
Memory illustrates the distinction. The context builder identifies the scope where memory may be written and the scopes from which memory may be recalled. If the current posture allows selected sharing, authorized source scopes can be added to recall. When several scopes contribute facts, the returned material is labelled by source so the agent can distinguish a personal fact from a channel fact. The result is not “all memory available to this person.” It is the set of memory sources permitted for this turn, under this audience and this target scope.
The same logic applies to files and skills. Ordinary grants provide handles that the current audience can reach. Carried files from an approved shared source are exposed as read-only handles, rather than as a second writable workspace. Skills are selected from scopes that the turn may use and from grants that the audience can collectively reach. The core records cross-context reads, which makes the origin of a resource part of the audit story instead of flattening every input into anonymous prompt text.
Imagine a project conversation where the participants are allowed to use a shared research skill and consult a personal note that its owner deliberately carried into the room. The skill can shape how the agent works, the note can answer a narrow factual question, and the channel's own workspace can hold the resulting plan. Those are three different relationships even though the model receives them in one prompt: the skill is governed capability, the note is a read-only cross-context resource, and the plan is local channel work. If the note's grant is revoked or the owner leaves the relevant shared context, the next turn should not treat the old prompt inclusion as a continuing right.
The distinction also makes failure behavior more intelligible. When the conditions for open sharing are not met, the normal conversation need not disappear; the source scope simply does not enter the turn-local view. The agent can continue with the target scope's own resources, or tell the user that the requested context is unavailable. A bounded refusal is preferable to silently widening the audience or falling back to a private resource that the room has not been authorized to receive.
Open sharing is deliberately conditional. QM's open posture applies to live, authenticated internal human turns, not to every kind of automation or ambient activity. Current membership must be checked. In a channel or group, the actor's personal resources can be carried only when the actor is still a member of the target scope. In a personal conversation, QM searches recent shared contexts, rechecks membership and posture for each candidate, and stops after bounded limits: at most 25 shared contexts, drawn from up to 100 recent session candidates, with file discovery capped at 200 files. These bounds constrain discovery; they do not convert the model into a privacy filter.
The read-only rule is as important as the eligibility rule. A person may choose to let a shared conversation consult selected material, but the carried context does not thereby gain permission to write into the source scope. Writes remain associated with the current writable scope. Credentials and approvals do not become ambient merely because a file or memory source is visible. Security screening and egress rules also remain part of the current turn's normal policy rather than being bypassed by the act of sharing.
The audience-wide check closes a subtle gap between personal entitlement and group authorization. Suppose a person has access to a private design note and asks QM to summarize it in a project channel. The sender may be entitled to read the note, but the other channel members may not be entitled to receive its contents. A group reply is an effect on the whole audience. QM's access calculation therefore requires the audience to be able to reach the granted resource or its owner through the relevant scope relationships. The person who owns a resource, or the manager of a managed shared scope, controls grants; another recipient cannot silently re-share it just because it was once visible to them. That rule preserves a chain of responsibility. The person who chooses to share a resource remains distinguishable from the person who happens to consume it, and a change in membership can be applied without asking the model to remember who was entitled yesterday.
The same reasoning helps separate three kinds of “read.” The agent may read the target conversation's own workspace as part of ordinary work. It may read a resource granted to the current audience. Or it may recall memory from a source scope that has been admitted for this turn. Those reads can arrive together in the model context, but they carry different ownership and provenance. Treating them as one undifferentiated directory would make later auditing and revocation much harder.
This is why scope resolution should not be confused with mounting directories. A directory answers where bytes can be found. A turn-local view answers a richer set of questions: which bytes, which memories, which skills, which policy, which audience, and which provenance labels belong in the current request. The view can change when the conversation changes, when membership changes, or when sharing posture is tightened. The agent sees a projection of authorized context, not a universal computer assembled from every resource the actor could possibly reach.
That projection also has a boundary the security policy states plainly: making data available to a turn does not ensure that the model will keep unrelated private facts out of its reply. QM can reduce unnecessary exposure by limiting discovery, keeping carried access read-only, labelling sources, and auditing reads. It cannot treat model output as a disclosure control. The architecture therefore combines a narrower input context with an explicit residual risk rather than claiming that authorization alone solves communication.
The turn-local model gives QM a stable handoff to the next part of the system. The harness can use the context to reason and call tools, but the meaning of that context remains tied to the scope and audience that produced it. When the turn ends, some state may remain in a workspace, memory notebook, or session record; other visibility disappears with the view. The next chapter follows that distinction into the scoped computer and the different forms of durable work.