A private assistant never has to ask the most basic question of social life: is this addressed to me? Every message in a one-to-one chat is. The moment an agent joins a shared space — for us, a Slack channel, where a team tags it into real work — that certainty inverts. Most of what it now hears is not for it. Colleagues talk to each other, threads branch, someone @-mentions a teammate two lines after mentioning the bot. Humans resolve all this without noticing, using names, threads, and a lifetime of conversational instinct. The agent gets a stream of text events and has to reconstruct the same judgment from what the room actually gives it: names, threads, and time.
What it earns by getting that right is the reason to put an agent in a channel at all. A team that tags one assistant into its shared work gets a teammate whose progress everyone can see and whose memory belongs to the room, instead of five people briefing five private tabs. The design has three parts, and they are the three things a person does without noticing: know when you have been asked, know how long a conversation you were drawn into stays open, and know when to stay out. The first is the easy half. The other two are where the design lives.
Tagged work, done in the open
The explicit case is the easy half, and its design goal is teammate, not tab. Someone writes @-the-agent with a task — pull last week's signups, draft the reply in this thread — and the agent acknowledges within seconds, then works asynchronously and in the open: a posted, updating checklist in the thread, progress visible to everyone, a terminal state everyone can see. The openness is the point of putting an agent in a channel at all — the alternative is each person briefing a private assistant from scratch, and the difference between "everyone has an AI tab" and "the team has a teammate" is precisely that the work, and the context, are shared.
Shared context is structural, not stylistic: memory is ringfenced per channel. What the agent learns in a channel belongs to that channel — a second person can follow up on the first person's task without re-establishing anything, because the room remembers, while cross-channel reads default off, because what a team discusses in one room is not ambiently available to another. The channel is simultaneously the addressing scope, the memory scope, and the governance scope (which tools it may use, what it may spend — an admin decides per channel). One boundary, three duties.
The follow-up problem
Then the hard half. Real conversation does not re-tag every sentence. Someone tags the agent, gets an answer, and replies "can you break that down by region?" — untagged, obviously for the agent, and a bot that ignores it feels broken. But a channel is also full of untagged messages that are not for the agent, and this is where the two ways of being wrong turn out to be different sizes.
A missed follow-up costs a re-tag. An answer to a message meant for a colleague costs the room's trust in the agent, and we treat it as the one failure the design must not commit: an agent that talks over people in a shared space has stopped being a teammate. So every threshold here is asymmetric, generous where intent has already been established and conservative where the venue is noisy.
The design resolves it with windows of established intent, two of them, deliberately different sizes. In a thread the agent has posted in, any participant's replies continue the conversation for twenty minutes with no mention needed — the thread itself is the intent signal; people who join a thread the agent is working in are, by the room's own social rules, talking to the working party. At the channel's top level, only the person the agent just answered gets a window, and a much shorter one — six minutes — because top-level chatter is far noisier and belongs to everyone. Outside any window, silence: an untagged message reaches no machinery at all.
One boundary fell out of the event model rather than the design, and we wrote it down as a decision instead of letting it pass as an implementation detail: the continuation windows exist in public channels only. The event subscriptions that feed them do not include private-channel traffic, so in a private channel tagging works but untagged follow-ups do not — and extending that would be a deliberate choice about listening in private rooms, to be made on purpose someday or never, not smuggled in as a scope tidy-up.
What transfers
Any agent entering shared space inherits this problem — a Teams bot, a shared inbox, a group chat — and the shape of our answer travels. Rank the failures first: in shared space, false positives (answering what wasn't yours) cost trust and false negatives cost a re-tag, so thresholds must be asymmetric. Make intent windows explicit — addressing is established by events (a tag, a reply, a thread) and decays with time and venue noise, and encoding that beats any per-message classifier. Put the prohibitions in deterministic filters and only the judgment in the model. And scope memory to the room, not the person — the room is what the participants share, and an agent whose memory leaks across rooms has turned the org chart into an ambient surveillance diagram.
Postscript, August 2026. The build landed through August, and two of its lessons were things no design document would have found. First, the never-answer-someone-else's rule needed a regression fix in exactly the place the funnel predicted: messages @-mentioning other users inside a live thread window had to be filtered before acknowledgement, not after — the check exists so a thread the agent shares with humans stays a place where humans can talk to each other. And second, an identity saga we did not see coming: the bot's display name is ours everywhere, but its @-handle is assigned per workspace, first-come — and one ordinary employee connecting their personal Slack account can claim the handle for the whole workspace long before the team bot installs, leaving the real agent as @ourname2 beside a dormant look-alike. The consequences became rules: never hardcode a mention-shaped string anywhere a user might type it or a model might echo it (a unit test now reads the source and fails on any such literal); resolve the real handle from the live installation when it genuinely must be printed; and detect look-alike name collisions from the workspace's current state, never inferred from the frozen handle. An agent's name, it turns out, is not something it owns. It is something the room assigns — which, for a chapter about learning to live in shared space, is almost too on the nose.