Collaboration Without Collapse

QM's security controls constrain what a turn may do, but collaboration asks a different question: what context may cross from one scope into another, and who may receive the result? This chapter examines QM's two-axis model of sharing and security, then follows both a carried resource in a live turn and a durable session share. The practical judgment is whether a proposed collaboration is a deliberate, audience-bounded transfer or an accidental widening of authority.

Sharing is a controlled transfer, not a larger workspace

QM's default sharing posture is Isolated. In that mode, resources stay in their scope unless an explicit grant makes them reachable. Open is a separate posture and a deliberate disclosure trade-off. It can allow selected personal files, artifacts, skills, and memory to enter a live internal conversation, but only under conditions such as a live authenticated human turn, current membership, and compatible source and target posture. Open does not turn a person into a universal bridge between every context they can access.

This is the first axis. It answers whether authorized cross-context material may be carried into the current turn. The security posture is the second axis. It still governs screening, approval, and action friction. A shared file can be authorized for read-only use while its contents remain subject to Auto screening. A user may share a document with a channel while the document's credentials, writes, and egress policy remain outside the transfer. Treating Open as a security bypass would collapse two questions that QM intentionally keeps separate.

Audience-wide entitlement is the key constraint. Suppose one person can read a private design document and asks an agent to summarize it in a project channel. The sender's permission is not enough. Every participant who may receive the channel response must be entitled to reach the resource or its owner through the relevant scope relationships. Otherwise, an ordinary request from an authorized person could turn into an unauthorized disclosure to everyone else in the room.

The rule can feel stricter than a personal assistant's model because a group reply is an effect on the whole audience. That is precisely why it is useful. QM does not ask the model to infer that a private document “probably” belongs in a shared discussion. It makes the audience part of the access calculation. If the group is not collectively entitled, the source is left out of the turn rather than being carried in on the strength of the sender's access alone.

Open sharing is bounded even when it is eligible. In a channel or group, the actor's personal resources can be carried only after current membership is confirmed. In a personal conversation, QM considers recent shared contexts, rechecks membership and sharing posture for each candidate, and uses bounded discovery: no more than 25 shared contexts from up to 100 recent session candidates, with file discovery capped at 200 files. These limits reduce ambient discovery, but they are not a proof that private information cannot be disclosed.

The carried resource remains read-only. A file from another scope appears as a handle the current turn may consult; it does not become a writable layer for the source scope.