the Senses.
Perception. How the organism sees and serves the outside world: one record, many private views.
the challenge
76%
71% of consumers expect companies to deliver personalized interactions, and 76% get frustrated when this does not happen.
People expect their own experience. Give everyone the same one and they leave.
A model serves everyone the same generic view. To make it personal, teams face a bad choice: bolt per-user plumbing onto a single system and hope the filtering is correct, or stand up a separate system per audience and multiply the cost. And the moment more than one person shares a system, the real risk arrives: one missed check leaks the wrong person’s history into the wrong person’s view.
where today falls short
One generic view is not perception, and an app-layer filter is where it leaks.
Serving each person their own private, correct view today means filtering in application code: a WHERE clause the developer must remember to add on every read, in every path. Miss it once and a query returns rows that belong to someone else. Isolation that lives in the app is isolation that eventually fails, because it depends on every query being written perfectly forever.
The organ of perception
How the organism sees.
An eye takes one scene and renders the single image its owner needs to act. The Senses do the same with the record. Every audience queries the same governed data, and each is shown only the slice that belongs to them, enforced underneath and never assembled by hand. The diagram below follows one record as it becomes many private views.
the answer
One record, many private views. The database enforces who sees what.
Everyone queries the same table. There is no per-person system and no "if user is A" branch in the code. Row-level securityA rule the database engine enforces itself on every read and write: it filters which rows each person can see, and refuses writes to rows they are not allowed to touch, so the application never has to get the filtering right. on the person id gives each person only their own rows, enforced inside the database on every read, so the same source of truth projects to a different private view for each audience. Two people can query the identical record and never see a trace of each other. The isolation is guaranteed by the engine, not by remembering to filter.
more than a view
What one governed record has that a per-audience system doesn't.
A separate system per audience is cost and leak surface. One record with per-person isolation is many private views from a single source of truth, and the database keeps them apart.
One record, many views.
!Today A lone agent serves everyone the same generic view, and personalizing it means bolting on per-user plumbing.
the cell One source of truth projects to many private views, per role and per person. Change the record once and every view reflects it, because they are all the same record seen through different lenses.
Private by construction.
!Today A lone agent keeps two people apart with app-layer filters, and one missed WHERE clause leaks the wrong history into the wrong view.
the cell Two people query the same table and each sees only their own history. Row-level security on the person id enforces it inside the database, with zero app-layer filtering, so there is no query left to get wrong.
Serves the world, not just one account.
!Today A lone agent’s memory is one context; serving a second, separate customer means standing up a whole second system.
the cell The same governed record already serves an individual alongside an account, each one isolated and each one remembered. One organism, many tenants, proven beyond a single account.
from our own systems
The senses, serving today
This is not a mock-up. One governed record projects to a private view for every person, each isolated by row-level securityA rule the database engine enforces itself on every read and write: it filters which rows each person can see, and refuses writes to rows they are not allowed to touch, so the application never has to get the filtering right. and each remembered, and the same record already serves an individual alongside an account. The identities are never published; the mechanism is the proof.
Green is a real figure from our database, as of Jul 29, 2026; in the diagrams, a committed write.
4
per person
an individual
zoom in
Down to a single allowed row
One record, projected to one person’s private view, filtered by the engine down to a single row that person is allowed to see. That is the smallest unit of the senses: not an app deciding what to show, but the database deciding what exists for you.
Curious how a layer like this would fit your own records?