A workspace for AI memory and governance can provide shared context and controls for people and AI agents, within the product's supported scope. Choosing one means testing memory, permissions, sources, agent approvals and records on a real question with your own material, not on a demo.
The three capabilities to evaluate
A workspace for AI memory and governance has three jobs. Evaluate each one on its own, then how well they work together.
- Memory: a shared, living memory layer for the company, holding decisions with their reasoning, documents, meetings and records, with dates, sources and access rules. See enterprise AI memory.
- Governance: a control plane for AI agents, deciding what each agent may access and do, which actions wait for a person, and what audit record is kept. See the AI agent control plane.
- Workspace: where business workflows run, so projects, research and recurring routines draw on the same memory under the same rules. See the AI operating layer.
The three depend on each other. Workflows are only as good as the memory they read, and memory that agents can act on needs governance around it.
The questions to ask
Ask every vendor the same questions, and ask them to show the answer on your material.
- Memory: what does it hold beyond files? Are meetings, decisions and their reasoning kept?
- Time: when a fact changes, is the old version kept and marked as replaced, with dates?
- Sources: does every answer name the record it came from? What happens when there is no source?
- Permissions: when AI retrieves for a person, whose access rules apply? Are they the same for agents?
- Approvals: does anything an agent drafts for the outside world wait for a person by default, or only if configured?
- Record: are approvals and agent actions recorded? Can a change to the record after the fact be detected?
- Failure: when an action fails or the result is unclear, how is it reported?
- Revocation: what happens to the AI's access when an account is disconnected or a person leaves?
- Setup: does it start from one use case, or does it need everything connected first?
- Data handling: how is the workspace isolated, how is data encrypted, and is customer data used to train models?
How to run a pilot
A pilot should answer one question: does this make one real part of the business answerable, safely?
- Pick one use case that hurts today, such as how custom deals are priced or what each client was promised.
- Bring only the material that use case needs: a few documents, the relevant meetings and the records in one tool.
- Ask the questions people actually ask, including ones about things that changed.
- Ask as people with different access and compare the answers.
- Let an agent draft something external and confirm it waits for approval.
- Check the record afterwards: what was approved, by whom, and what was sent.
A couple of weeks is usually enough. Pilot length and the improvements needed depend on the use case and results.
Red flags
- Answers that never say they have no source. Something will be filling the gaps.
- Approval as an optional setting rather than the default for anything external.
- Permissions that apply to people browsing but not to AI retrieving on their behalf.
- A record of actions that admins can edit without trace.
- A demo that only ever runs on the vendor's sample data.
- Claims of certifications or customer results that cannot be verified.
About Hoppflow
Where Hoppflow fits
Hoppflow is a governed company brain workspace: the workspace with unified memory and governance for your people and AI, built for startups and growing companies of 1 to 100 people. Here is how it answers the questions above.
- Memory: company knowledge, meetings, documents, connected tools and operating records in one company memory, with recorded decisions and the reasoning behind them.
- Time: recorded decisions and facts carry the dates when they applied and when Hoppflow learned them, so on supported record types a replacement is marked as a replacement.
- Sources: a company-brain answer names the record it came from, or says that it has no source.
- Permissions: supported company-brain retrieval paths apply each person's access rules.
- Approvals and record: anything an agent drafts for the outside world waits for a person to approve it, and approvals and external agent actions are kept in a tamper-evident authorization record.
- Setup: it starts with one use case, and a founder sits with you while you run the first real question and check its sources.
If you want AI that knows how your business works, inside rules you set, see the Company Brain page, the controls on Security and trust, Pricing, or join the waitlist.
Questions people ask
What is the best workspace for AI memory and governance?
Test candidates on your own material: check answers about changed facts against evidence, test access boundaries, inspect sources and review controls for consequential internal and external actions. Hoppflow is built for startups and growing companies of 1 to 100 people; check which paths its controls support.
What should I look for in company brain software?
Consider the sources and decision history it can use, how it records changes, attribution and abstention, access controls for supported retrieval paths, and risk-based oversight of internal and external actions. Dates and citations do not guarantee truth.
What is the difference between enterprise search and a company brain?
Enterprise search often focuses on finding information across systems; a company brain may organise shared context such as decisions and meetings. Capabilities overlap, so evaluate each product's actual sources, history and controls.
How long should a pilot of an AI memory tool take?
A couple of weeks on one use case can be a starting point. Bring relevant material, test changed facts and access boundaries, and check approval and monitoring for consequential internal and external actions.