Defender Impact
Almanac introduces a structured, source-linked knowledge layer over disparate SaaS tools — giving security and operations teams an auditable, correctable record of AI-synthesised internal decisions. For organisations struggling with shadow-knowledge sprawl across Slack, email, and docs, this closes a meaningful observability gap.
Capability Overview
Almanac is a persistent AI agent backed by Y Combinator (S26) that operates with its own browser, file system, and authenticated sessions into connected tools. Its core mechanism is a self-updating internal wiki: as work happens across Slack, Gmail, Granola, GitHub, and other integrations, Almanac synthesises the relevant understanding — decisions made, commitments given, open issues — into structured wiki pages. Crucially, every wiki entry links back to its originating source, so any reader (human or automated process) can validate the provenance of a claim.
The agent operates in two modes: task execution (initiated by the user via Slack or iMessage) and proactive monitoring (Almanac notices something worth doing and surfaces it without being asked). At defined thresholds — logins, payments, decisions flagged as requiring human judgement — it pauses and requests confirmation or hands control back to the user via a live browser session.
Access scoping is per-user by default. Individually connected accounts are not shared organisation-wide; only distilled understanding flows into the shared wiki, not raw inbox content. Shared accounts must be explicitly added by the organisation.
Defensive Advances
Auditable AI action trail. Because every wiki line links to its source, security teams can trace how the agent reached a conclusion and verify it against primary evidence. This is a meaningful step beyond black-box AI summarisation.
Revocable, visible integrations. A single integration list that administrators can inspect and revoke provides a practical control surface — something many agentic tools have historically lacked.
Human-in-the-loop at high-stakes actions. Explicit checkpoints before payments, logins, and consequential decisions reduce the autonomous action surface and give defenders a model for where to concentrate monitoring.
Wiki-correction as a ground-truth mechanism. When the wiki is wrong, a human correction immediately propagates to the agent’s working knowledge. This gives defenders a correction pathway that doesn’t require retraining or a support ticket.
Scoped data sharing. The architectural separation between raw personal data (stays with the individual) and synthesised organisational understanding (shared wiki) is a reasonable privacy boundary that limits lateral exposure.
Residual Gaps
Wiki poisoning surface. The wiki is the agent’s primary context. If adversarial content reaches the tools Almanac monitors (e.g., a crafted Slack message, a malicious email), it may be synthesised into wiki entries and subsequently acted upon. The maturity question is: what input validation and anomaly detection exists on the ingestion pipeline?
Scope of autonomous browser action. The “signs into your tools and uses them like you would” capability is powerful but requires clear organisational policy on what actions are in-scope. Organisations should not assume Almanac’s default checkpoints align with their risk tolerance without reviewing them explicitly.
Credential storage and session security. An agent that maintains persistent authenticated sessions across many SaaS tools represents a high-value credential aggregation point. The security of those stored sessions and how they are isolated will be a key maturity question for enterprise adopters.
Wiki accuracy at scale. As the number of connected tools and users grows, the signal-to-noise ratio of synthesised wiki entries becomes harder to maintain. Organisations will need governance processes — wiki owners, review cadences — to prevent the wiki from becoming a source of overreliance.
Audit log granularity. The product surfaces action visibility (“you can watch every step of a run”), but it is not yet clear whether this produces a durable, exportable audit log suitable for compliance or incident response purposes.
Framework Mapping
The wiki-as-RAG architecture maps directly to AML.T0070 (RAG Poisoning) and AML.T0071 (False RAG Entry Injection) as surfaces defenders must govern. The browser agent capability is relevant to AML.T0086 (Exfiltration via AI Agent Tool Invocation) and AML.T0098 (AI Agent Tool Credential Harvesting). OWASP LLM08 (Excessive Agency) is the primary category — Almanac’s checkpoints are a partial mitigation, but organisational policy must complete the control. LLM09 (Overreliance) is a secondary concern as wiki accuracy becomes load-bearing for business decisions.
Deployment Considerations
Organisations should treat Almanac’s integration list as a privileged access review surface — apply the same scrutiny as OAuth application governance. Start with read-only integrations before enabling write-back actions. Define a wiki ownership model before rollout: assign domain owners responsible for validating AI-synthesised entries in their area. Review Almanac’s default human-approval thresholds against your organisation’s risk policy and extend them where needed.
Defender Checklist
- Inventory every tool connection granted to Almanac and apply least-privilege scoping
- Assign wiki page owners for sensitive domains (customers, pricing, security)
- Review default autonomous-action thresholds and extend human-approval requirements to match organisational risk policy
- Establish a periodic wiki accuracy review cadence
- Assess credential storage and session isolation before connecting high-privilege accounts
- Determine whether Almanac’s action logs meet your audit and compliance requirements