Last time, the building got doors. Tony Stark and Alexander Pierce could finally query the same SHIELD cabinet and see two completely different organisations. But this was still a local story: me playing Context Owner with root access on my laptop.
This chapter is about what happens when an AI agent actually shows up and asks for the keys.
Most modern “agent integrations” answer that request with a dump truck. You paste the entire Google Drive into the context window and cross your fingers. ESC does the opposite. The agent gets a doorbell and a permissioned table of contents. If it needs a PDF, it fetches it from the source—just like a careful human.
To emulate a real agency environment, we moved the core system off my laptop and onto a VPS at esc.diuldia.com.
How an agent actually knocks
The bridge between agent and server is deliberately boring, relying on the same access control spine we built earlier:
- Rules and introductions. The agent gets a personalized instruction pack (system prompt and skills), but no hardcoded keys. Rules are just prompts, not security boundaries.
- Remote HTTP. When the bot asks for a file using its token, it gets a filtered list of exactly what it’s allowed to see.
- The local slice. For deeper work, you can opt-in to pull a permissioned slice of the index to your local workspace, working offline but checking generation numbers before trusting the cache.
- No MCP (Yet). I refuse to invent a parallel permission brain just because a new protocol is trending. For now.
The walls survived the move to HTTPS. Tony’s agent sees a thicker building; Pierce’s agent sees a restricted slice.
The cabinet that refreshes itself
A hosted catalog is useless if it ignores reality. ESC keeps a few boring counters (source revisions, catalog generations) so clients can poll their sync status. When Knowledge Basein shared folder, or on GitHub updates, a quiet background job picks up changes or the new tree.
It’s not glamorous, but it’s the difference between a static screenshot and an agent getting an honest, up-to-date answer next Tuesday.
Wikis: scaffold upstairs, handwriting downstairs
A compiled LLM wiki is the sugar on top of the catalog. On the server, building a wiki just means building the scaffold: snapshotting the filtered index and drawing the map.
It does not mean spinning up a rogue coding agent on a VPS to rewrite company docs overnight. Rich pages are still compiled locally by an agent under human supervision, then packed and pushed up. The server acts as the hotel; the thoughtful editing still happens at a desk. That’s how you avoid paying for an unsupervised AI running up your cloud bill.
What I still refuse to fake
There is no full Context Owner UI yet, and the homepage is intentionally thin. Also remember: while server APIs enforce access, an agent’s internal auto-memory can still hallucinate and mix client data. Walls at the front door cannot fix a messy desk inside the house.
Next
The filing cabinet finally has a public address. The agent knows how to knock. Next time, the Context Owner’s desk finally moves into the browser. We will look at user grants, wiki toggles, and answering the ultimate panic question – what exactly can Pierce see? – without SSH.
For now: a door, not a dump truck.