Skip to content
Personal Learning Notes
7 min read

Reading Glean: the moat is not the model, it is permissions and context

After going through the public material, my conclusion is that what makes Glean valuable is not that its search is good — it is that it finished the grinding work of "who is allowed to see what". Also my take on the claim that long context kills RAG.

I am building an agent runtime, so the question I carry around is: what is actually missing when you try to run agents inside a company? Reading about Glean, it became clear that it fills exactly the layer sitting above mine — context and permissions.

These are notes from public sources, not first-hand research. Every number comes from the references at the end, I have not verified the financials, and I have no relationship with Glean. I am writing it down mainly to have a record of my own reasoning I can come back to.

What it is

Founded in Palo Alto in 2019. Arvind Jain spent years at Google on search ranking and distributed infrastructure, then co-founded Rubrik. The starting point was concrete: as Rubrik grew past 1,500 people, the biggest drag on the team was that people could not find knowledge or the right colleague across departments — the data sat locked inside a hundred-odd disconnected systems: Google Drive, Slack, Jira, Confluence, Salesforce.

The product started life as “Google for work”. Today it positions itself as the enterprise context layer and agent orchestration hub.

Round Date Amount Post-money Focus
Series C 2022-05 $100M $1.0B Commercialisation at scale
Series D 2024-02 $200M $2.2B Generative AI, launch of Assistant
Series E 2024-09 $260M $4.6B Agents, shift toward automated workflows
Series F 2025-06 $150M $7.2B Agentic Engine 2 and Canvas

Commercially it moved fast too: ARR crossed $100M in February 2025 and doubled to $200M in roughly nine months. Customers include Databricks, Duolingo, Instacart, Pinterest, Reddit and Samsung.

The part that is actually hard

The architecture has five layers: connectors, knowledge graph, permission governance, model routing, front-end applications. Only one of them is hard to copy quickly.

Connectors: unglamorous, and it takes years

More than 100 zero-code connectors covering Google Workspace, Microsoft 365, Slack, Salesforce, Jira, Confluence, GitHub, Zendesk and the rest. The count is not the point — what matters is that they extract more than body text: metadata, organisational relationships, and access control lists.

Ingestion is deliberately mixed. High-traffic documents and tickets are fully indexed for millisecond responses; sensitive or fast-changing data like calendars and mailboxes is fetched live at query time. That compromise is pragmatic — pure indexing over-concentrates sensitive data, while pure federated search dies on API rate limits and latency.

Knowledge graph: making “that design doc they mentioned in Slack yesterday” resolvable

The graph maps three entity types in real time: content (documents, code, email, tickets), people (identity, role, reporting lines), and activity (edits, clicks, dwell time, discussion intensity). A query runs BM25 lexical search, vector search and graph-based personalised re-ranking in parallel, reportedly inside 300ms, with per-claim links back to the source document.

Pure vector retrieval cannot handle internal jargon and abbreviations — I have hit this myself. Semantic similarity happily generalises “that thing we call X internally” into completely unrelated documents.

Permission mirroring: this is the moat

Glean does not build its own permission system. It mirrors the source systems’ ACLs and attribute-based rules in real time, and the retrieval filter cuts unauthorised documents at the index layer — they never reach the model’s context at all.

Why this matters: a lot of enterprise RAG projects die here. An ordinary employee prompts their way into executive compensation or unreleased financials. It only has to happen once.

And you cannot algorithm your way around it. You have to model every source system’s permission semantics individually, then keep up as their APIs change. It is pure grinding engineering work — which is exactly the kind of gap model vendors are worst at closing.

Model neutrality

A built-in Model Hub switches between Amazon Bedrock, Google Vertex AI and Azure OpenAI, supports bring-your-own-key, and integrates 15+ models. It also leans hard into MCP, acting as both server and host, so it can coordinate external agents without re-extracting data.

The business model: seats plus usage

It moved from pure per-seat licensing to “base seats + Enterprise Flex credits”. Search and basic Q&A come with the seat; advanced reasoning and agent invocations draw down a credit pool.

The interesting part is not extracting more money — it is that revenue now tracks agent execution density rather than headcount. The growth ceiling of traditional SaaS is the customer’s employee count. In an agent world that assumption stops holding.

Stickiness is worth noting too: enterprise SaaS typically runs 10%–20% DAU/MAU; Glean reportedly reaches roughly 40%, comparable to Slack or Teams, with active users running five or more queries a day.

What the fight with Copilot is really about

Microsoft 365 Copilot is the competitor it meets most often in deals, but the two start from different premises.

Dimension Glean Microsoft 365 Copilot
Position Vendor-neutral context layer across everything Productivity assistant embedded in the 365 estate
Data breadth 100+ third-party SaaS mapped as equals Microsoft Graph first; quality degrades outside it
Permissions Mirrors each system’s ACLs; also flags active over-sharing Inherits SharePoint/OneDrive permissions, so historical sprawl gets amplified
Agent building Zero-code builder aimed at business users Developer-oriented; needs Azure AI Studio, Power Automate
Models 15+ models, bring-your-own-key Bound to OpenAI / Azure OpenAI
Pricing Seats + flexible credits ~$30/user/month fixed add-on

Copilot’s advantages are installed base and bundled price. But almost every mid-size and large company runs a heterogeneous stack — Slack for chat, Jira for tracking, Salesforce for customers, Google Workspace for documents, all at once. In that environment neutrality is not a posture, it is a difference in reach.

One more detail: as OpenAI pushed toward ChatGPT Enterprise and agents, Sam Altman reportedly warned investors away from Glean. What OpenAI lacks there is not model quality — it is the connector estate and the permission pipeline.

Three things I want to remember

One: the missing piece is context, not reasoning. The last decade of enterprise software was systems of record — CRM, HR, ERP. After large models arrived, the constraint moved from “cannot reason” to “does not know what is going on inside this company”. Whoever supplies who-can-see-what, how-we-got-here and where-it-stands becomes the hub.

Two: long context does not replace RAG, at least not in enterprises. I half-believed this claim before. Inside a company it runs into three hard constraints:

  • The context window is an open channel. Once data is loaded, the model cannot isolate unauthorised information mid-inference — permission boundaries simply stop existing
  • Carrying the full corpus on every interaction is unacceptable on both token cost and time-to-first-token
  • Enterprise data is not only static text; it includes live signals between people and documents that are nowhere in the text

Three: the bottleneck for agents has moved from capability to authorisation. What blocks companies today is not whether an LLM can plan several steps ahead — it is whether the system can be trusted to perform write actions. Once an agent can send email, change CRM status or touch a repository, one hallucination or one permission slip is an incident. Whoever owns the governance gate for agent actions owns the pricing power.

That holds for my own project too: however solid an agent runtime is, if it cannot answer “should this action be allowed”, it is unusable inside a company.

What I have not worked out

  • How long neutrality survives. Cloud and SaaS incumbents have every reason to make a defensive acquisition, and the moment that happens the neutrality story evaporates. Staying independent to IPO takes real discipline.
  • Whether Flex pricing eats the margin. As agents move to multi-step adaptive execution, backend model costs climb fast. Usage-based pricing looks like revenue elasticity; it is also cost exposure.
  • How fast Microsoft closes the gap. SharePoint and Microsoft Graph retrieval keeps improving. If Copilot is discounted or bundled free, budget-sensitive mid-market customers move first.

References

The facts and figures above come from the sources below; the judgements are mine.