Give Your Agents Their Own Wiki. Keep Your Vault to Yourself.

This week's X feed is still selling the same shortcut: clone a repo, point Claude at your Obsidian vault, and let it "write the notes itself." Karpathy's LLM Wiki and Garry Tan's GBrain are on every list. The pitch is one brain, shared with the model.

A quieter point landed on November 11. Steph Ango (kepano), who builds Obsidian, said the major new thing in his setup was not a fancier personal vault. It was a separate LLM wiki vault for agents to use.

That split is the product decision most of the repo lists skip.

The bug is not missing memory. It is one room for everything.

A personal vault is a working surface. It holds journal fragments, draft rants, compensation notes, unreleased plans, and half-true scratch. That mess is useful to you because you know what is private, stale, or a joke.

An agent does not. If you point it at the whole vault, two things happen at once:

1. It can read things it should never see, then repeat them in a stand-up, a pull request, or another teammate's session.
2. It writes back. The week's popular hooks advertise this as the feature: the model files sources, links pages, and maintains the wiki. A result circulating from Anthropic's agent-memory work showed the failure mode on a shared table: several agents wrote contract terms at the same time and overwrote each other. A brief built from that wiki kept only 41 of 57 graded facts. The fix was not a bigger model. It was one page per contract, one writer per page, and quoted terms.

Shared memory is useful. Unscoped shared memory is how one bad assumption, or one private sentence, travels farther than you intended.

Two vaults, three permissions

Treat the agent wiki as a room, not as a synonym for "everything I have written."

Vault A — Human working surface.
Your daily notes, whiteboards, and drafts. People edit here. Agents do not get a credential to this space by default.

Vault B — Agent-readable wiki.
Curated pages the model may search and cite: runbooks, architecture, current decisions, onboarding. Raw sources stay immutable. Synthesized pages can be generated, but they live here, not in your journal.

Then set three permissions, in this order:

• May never read
• May read
• May write — last, and rarely

If you are writing a schema file (AGENTS.md, CLAUDE.md, or the equivalent), make the boundary explicit:

• Answer only from the agent wiki, and name the page
• Do not search the human vault
• Do not write unless the task is labeled as an approved ingest
• If a fact is not in the agent wiki, say so — do not "helpfully" pull it from somewhere else

This is also why "close Claude Code, open Codex, pick up the same markdown handoff" only works if both tools are pointed at the same scoped wiki, not at four private memory stores that cannot read each other.

Where this belongs

A weekend folder hook will not hold this for a team. You need Knowledge base Software with spaces, permissions, and a place for those rules to live in the open.

If agents can search and cite only the spaces you allow, you have AI knowledge base Software. If you can run the workspace yourself — the thing people usually want from an Open source Notion alternative — you also get to decide which rooms a model never enters, and whether inference leaves the building.

AFFiNE's write-up on an LLM wiki for teams puts this first: decide which knowledge the AI may see, which spaces it may never read, and whether it may write at all, then start read-only. The companion guide to self-hosted AI for teams is useful here because the knowledge workspace is its own layer, separate from the model server and the chat UI. You can scope a credential to a workspace without retraining a model, and you can swap the model without granting it a new room.

AFFiNE, which I work on, is one option for that workspace layer: open-source, local-first docs, whiteboards, and databases, with optional BYOK AI and a workspace MCP server that is read-only by default. It is a weak fit if you only need a static handbook, or if you need agents to write into the workspace on today's stable release.

A one-hour access check

Pick the vault or workspace your agents already use.

1. List ten pages an agent has cited in the last week. Mark each one: should this have been readable?
2. List five pages that must never be readable: compensation, personnel, unreleased plans, private journals, credentials.
3. Confirm the agent's credential cannot see those five. If it can, revoke it and issue a narrower one.
4. If the agent has write access, turn it off except for a single ingest path with a human review step.
5. Point every tool — Claude Code, Codex, and the rest — at the same agent wiki, not at a private memory each vendor keeps.
6. Ask a question whose answer lives only in the human vault. The right result is "I don't have that," not a helpful leak.

If step 6 succeeds as a leak, you do not have a second brain. You have a sharing problem.

Bottom line

Persistence is necessary. Persistence of everything, to every agent, is how a second brain becomes a side channel.

Give the model a wiki it can cite. Keep the rest of the vault for the humans who know which pages were never meant to be answered from.