Two_Reports,_One_Cause

Every AI session that happens in a private DM contains evidence your organisation will never see. Not because it was classified. Because there was nowhere public to put it. The correction a senior developer made to a model's output — the framing choice, the push-back, the contextual knowledge about why this particular approach does not work in this particular system — lives in a chat history that closes when the tab closes. The junior developer on the next team starts from the same blank model tomorrow.

Meanwhile, a different research community is tracking a different problem. GitGuardian's 2026 State of Secrets Sprawl report found that AI service credentials exposed on public GitHub reached approximately 1.28 million in 2025 — up 81% year-over-year. The cause is structural: faster code generation means more credentials produced, more codebases, more people with model access. Credentials that a senior developer would have scoped carefully and committed to a secret manager are being written into code by a junior developer who produced the code in a private AI session, with no one watching, without the institutional knowledge about why that particular class of credential matters.

Two reports. Two research communities. One thinks about learning. The other thinks about credentials. Neither is typically reading the other.

They are describing the same session.

The_Structural_Pattern_They_Share

The connection is not metaphorical. The private AI session that produces a credential leak is the same session that contains pattern knowledge nobody else will ever see. One surface. Two simultaneous losses.

When AI work is private by default — personal browser sessions, individual model subscriptions, direct messages — the second reader has no structural way in. Not because the work is blocked. Because the surface has no visibility. A junior developer generates code in a private chat. A senior practitioner who would have recognised the credential risk is not present, not because they were uninvited, but because the surface they would have needed to see the work on does not exist. The institutional knowledge that would have stopped the leak is also absent from the session. The code is committed. The credential is in the repository. The pattern knowledge about how to handle this class of access token is still in the senior developer's head, sealed inside their own separate private sessions.

When the second reader has no structural way in, two things fail simultaneously — the organisation stops learning and credentials start leaking.

This is the synthesis most commentary misses. Training programmes do not solve secret sprawl. Data loss prevention tooling does not restore apprenticeship. They are detection and intervention tools that operate after the structural absence has already produced its damage. The fix is upstream. It is the surface.

What_the_Private_Default_Costs

The two failures compound in distinct ways, but they share the same compounding mechanism: scale.

The apprenticeship dynamic requires observation of practice under genuine conditions. A junior developer watching a senior colleague work in a shared channel sees the ambiguity framing — how the senior practitioner describes an underspecified problem to the model, pushes back on a suggested approach, verifies an output before treating it as settled. That craft transmission is not abstract. It is the specific, observable sequence of decisions that constitutes expertise. When the senior colleague's AI work moves to private DMs, the transmission stops. The junior developer interacts with the same models, in private, without ever seeing how the work is actually done by someone who knows more. Token volumes go up. Learning does not compound.

Credential leaking compounds differently but from the same root. The institutional knowledge that protects credential hygiene — the context about why this class of API key is sensitive, why this access token should not be committed, why the blast radius of a leaked key for this particular service is large — lives in the experience of people who have been burned before or have seen it happen. When code is generated in private sessions, that institutional knowledge is not in the loop. The model does not have it. The junior developer does not have it. The senior practitioner is not watching. The code ships. The credential enters the repository. Nobody knew to flag it because nobody was there.

Both failures compound with scale. Every private session that closes takes its evidence with it. Every organisation running high AI adoption on a private-default surface is accumulating two debts simultaneously, and neither shows up clearly on the dashboard that measures productivity.

Shopify_River_and_the_No-DM_Rule

When Shopify deployed River — their AI agent — across an organisation of roughly 5,900 people, the defining constraint was not about transparency in the abstract. In the most recent reporting period, River operated across approximately 4,450 public Slack channels, opened around 1,870 pull requests in a single week, and accounted for roughly one in eight merged PRs. The no-DM rule was architectural: an explicit decision about where learning accumulates.

Toby Lütke's framing invokes the Lehrwerkstatt — the German teaching workshop, where apprentices learn by doing visible work alongside experienced practitioners. River forces this dynamic because every session runs in a public channel. A senior engineer's #tobi_river channel drew over 100 participants who watched, in real time, how an experienced practitioner frames a problem for the model, evaluates the output, and decides what to accept or push back on. That observation is the apprenticeship. It happens because the surface is public. It would not happen in a DM.

The no-DM rule addresses both failures simultaneously. Learning accumulates because the work is visible. Credential risk is reduced because senior eyes are in the same channel by default — the institutional knowledge about what matters is present in the interaction, not imported after the fact by a code review that catches what a tired developer missed at midnight.

This is not a case study endorsement. Shopify's architecture is validation of the principle, not a prescription for copying it. The structural observation is simpler: the constraint — the friction of the public surface — is precisely what forces work into the visibility layer where it compounds. The frustration of having to create a public channel instead of sending a DM is not a design flaw. It is the design.

What_a_Declared-Rules_Architecture_Looks_Like_at_Smaller_Scale

The primitive is the same one I named in Verification Is the Primitive: making private judgment survive contact with a second reader. What changes at the organisational level is the cost of not doing it.

I do not run six thousand people. I run twelve specialised agents across roughly ten active repositories. The scale is different. The structural choice is the same: AI work documented in surfaces that a second reader can find, under declared rules about what goes where.

Three examples, each verifiable against the artefacts.

The fleet's entire routing logic — which agent is commissioned for what kind of work, what each agent can and cannot do, how tasks move between them — is documented in files any session or agent can read. The ~/.claude/CLAUDE.md agent coordination section and the ~/AGENTS.md fleet baseline carry the full dispatch logic. There is no private routing knowledge. A new session opening in this fleet does not need to reconstruct who does what from context window archaeology. The institutional knowledge about why Tom handles research, why Reid handles positioning, why Sheena dispatches rather than executes is in the documentation rather than in a context window that closed three weeks ago.

Cross-project decisions — architectural choices, accepted risks, surface conventions, language policy — are logged in decisions.md rather than buried in individual session histories. The Open Brain pattern captures observations and decisions-in-flight in real time, feeding into the log when they solidify. Any future session can interrogate why a given choice was made without needing to reconstruct the reasoning from scattered evidence.

At session end, the /handoff skill writes structured output to ~/.claude/state/last-handoff-{scope}.md — a durable, machine-readable record of what was decided, what was deferred, and what the next session needs to know. The judgment made in the session does not die when the context window closes. The second reader for the next session is the previous session's handoff.

These are not analogies to Shopify River. They are smaller-scale implementations of the same structural choice: AI work in surfaces that a second reader can reach, under declared rules about scope and access. The principle does not require six thousand employees. It requires a decision about the default.

The_Objection,_and_the_Answer

The predictable objection: AI work cannot be public. Regulated industries. Client confidentiality. Privacy constraints mean private sessions are the only option.

The objection conflates two different things: externally public and visible to a second reader under declared rules.

The primitive does not require publishing AI work to the internet. It requires that the work is visible to a second reader — a colleague, a senior practitioner, a future session — within a surface governed by declared rules about scope and access. A financial services team can run AI work in a designated internal channel with explicit access controls and documented scope boundaries. A legal team can document AI-assisted analysis in a matter-scoped workspace with role-based visibility. The surface does not have to be the whole internet. It has to be something other than the individual private session.

"Declared" is the operative word. Rules that are explicit, documented, and stated out loud create the accountability layer that the private surface cannot have. The second reader does not need to be the public. The second reader needs to be someone — under rules you have made visible — who can see the work and bring institutional knowledge to it.

The private-by-default position accumulates invisible debt in both directions: learning that stays locked in closed context windows, credentials that slip through because no one with the relevant institutional knowledge was watching. Declared-rules architecture makes the debt visible before it compounds. The constraint is stated, the scope is bounded, the work is seen by the people who need to see it.

The_Gap_That_Is_Opening

Two types of organisations are now accumulating at different rates.

One is building a corpus of visible AI practice: interactions that a second reader can learn from, credential decisions that have institutional eyes on them, sessions that produce artefacts visible to the people who need to see them. The pattern knowledge does not die when the tab closes. The junior developer can watch how the senior practitioner works. The institutional knowledge about what matters stays in the room.

The other is building a record that nobody can read: pattern knowledge sealed in closed context windows, credentials entering repositories because no one with the relevant context was watching, sessions that close taking their evidence with them. The productivity gains are real. The debt is invisible until it surfaces as a credential incident nobody can trace, or a junior cohort that has been using AI constantly for two years and cannot explain how to evaluate an output because they have never seen it done by someone who knows more.

The gap between them is not a culture gap or a tooling gap or a training programme gap. It is a surface gap. One organisation declared the rules and made the work visible. The other left the default in place.

The default is still private.