Your second data estate: governing organisational knowledge the way you govern operational data

Who this is for. CIOs, chief data officers and the heads of knowledge, records and information governance in organisations that run on meetings, reports and email as much as on systems of record: Defence and intelligence staffs, hospitals and health systems, financial services firms, agricultural cooperatives and large commercial enterprises. It assumes you already govern operational data well and asks what it would take to govern the rest.

1. Two estates, one of them governed

Every CIO can draw the first estate from memory. There are systems of record, each with an owner. There is a warehouse or a lakehouse the systems feed. There are pipelines with lineage, an access model that says who may read which rows, and an audit trail that says who did. When an auditor asks where a number came from, the answer is a query, not a conversation. This estate is expensive, and it earns its cost, because it is the part of the organisation's data that can be trusted at a distance by someone who was not there when it was made.

The second estate is everything else the organisation knows. It is the meeting at which the number was agreed before it was entered into the system. It is the strategy discussion that set the constraint the system now enforces. It is the field note, the chat thread, the recording of the call, the email in which someone finally said yes. Ask where this estate lives and the honest answer is: in a recording archive nobody searches, in shared drives with no owner, in SharePoint sites that outlived their teams, and in the inboxes and memories of the people who were in the room.

The first estate says what happened. The second says what was decided, by whom, on what reasoning, with what constraints, and what has changed since. In most organisations the second estate is larger than the first, it is where the consequential decisions are actually made, and it is ungoverned. Not badly governed: ungoverned, in the precise sense that it has none of the four properties the first estate was built to have.

2. What the second estate holds

It helps to be concrete about the material, because the vagueness of the word knowledge is part of why it stays ungoverned. The organisational record is made of ten kinds of thing: reports, chat, field notes, meeting minutes, strategy discussions, meeting transcripts, video teleconference recordings, email, shared drives and SharePoint. Each is produced in the ordinary course of work. None of it is produced for a system to read. That is the whole problem: the material exists, it is written down or recorded, and it has never been systematically leveraged, because no system takes it in.

The volume is not small and it is growing. Across Microsoft 365, the average employee now spends 57 percent of working time communicating, in meetings, email and chat, and 43 percent creating documents; people are in three times as many online meetings and calls per week as they were in February 2020.¹ More than half of the people surveyed in the same study say it is hard to summarize what happened in a meeting, and 55 percent say next steps at the end of one are unclear.¹ The organisation is producing more of its most consequential record than ever, and capturing less of it.

The cost shows up as time. A decade ago the McKinsey Global Institute estimated that the average interaction worker spends 19 percent of the working week, nearly a day, tracking down information needed to do the job.² A 2018 survey of a thousand employees at larger US organisations found them waiting 5.3 hours a week for knowledge held by a colleague, or recreating it, and estimated that 42 percent of the knowledge needed to do a role was unique to the person doing it: when that person leaves, that share of the job leaves with them.³ Every one of those hours is a search through the second estate for something that was said, decided or agreed and never landed anywhere a system could find.

3. The four properties the first estate has

Strip the operational estate down and it rests on four properties. Everything a CIO values about it follows from them.

Provenance. Every value in the warehouse can be traced to the system that produced it, the time it was produced and the transformation it passed through. Lineage is a property of the data, not a note in a wiki.

An access model. Who may read a record is decided per record, or per row, and enforced by the system rather than by etiquette. The same model applies to a person and to a programme acting on that person's behalf.

A supersession record. When a value changes, the old value is not overwritten and forgotten. The system knows what the value was, what it is, when it changed and, usually, why. History is kept, not lost.

A way to ask. You can put a question to the estate and get an answer that is reproducible: a query, a report, an API call, with the same answer for the same question until the data changes.

These are also, not by coincidence, the properties the records management profession asks of any authoritative record. ISO 15489 defines records as evidence of business activity and requires that, to be authoritative, they be authentic (what they purport to be, made by whom and when they claim), reliable (a full and accurate account, created close to the event by people with direct knowledge), of integrity (complete and unaltered, with any alteration identifiable) and usable (locatable, retrievable, presentable, with their context preserved).⁴ The operational estate meets that bar by construction. The organisational estate, as most organisations keep it, meets none of it: a recording has no provenance beyond its filename, a shared drive has an access model only at the folder, nothing records what superseded what, and there is no way to ask the archive a question except to open the files one by one.

4. Giving the second estate the discipline of the first

/TRUTH is Bluestaq's document-intelligence product, shipping today, and its job is exactly this: to give the organisational estate the four properties of the operational one. It does so by changing the unit of the record. The unit is no longer the file; it is the claim.

Documents, meetings, transcripts, recordings and email go in. /TRUTH distills them into atomic claims: single statements of what a source says, each carrying its source, its date and how it was grounded. That is provenance, at the level of the sentence rather than the file. A claim that a milestone moved to the 30th does not float free; it points at the contract modification, the date of the modification and the passage that says so.

Because claims are dated and sourced, supersession becomes a property of the record rather than a memory. When a later source changes a position, the newer claim supersedes the older one, and the older stays in the record, marked, so what changed and why is never lost. When two sources disagree and neither supersedes the other, the conflict is surfaced with both sides cited, rather than averaged into a summary that is wrong in a way nobody can see.

And because the estate is now made of claims rather than files, it can be asked a question. Rendered pages, search results and agent answers cite the claims and sources behind them; click a sentence and see the claim it came from. A question put to the estate gets an answer with a sources line, which is the organisational equivalent of a query with a lineage.

5. The access model: projects, people and agents

The property a CIO will press on hardest is access, because the second estate is where the sensitive conversations are. A leadership discussion about a restructuring and a programme's working notes cannot sit in one undifferentiated pool, and in most organisations they do not: they sit in separate drives with separate etiquette, which is not an access model.

In /TRUTH access is granted per project. A project is the unit of permission: material and the claims distilled from it live in a project, and a person reads what the projects they have been granted contain. The leadership discussion and the programme notes sit side by side in one instance under different permissions, and the tiering an organisation needs, a grower's private notes beside what a cooperative has agreed to pool, protected health information beside de-identified material, material non-public information beside what is public, is expressed as projects rather than as a policy document nobody can enforce.

The same model applies to software. Agents connect over MCP, with OAuth 2.1 and PKCE, and act as the user: an agent sees only what the person it is working for may see, which is the only access model for agents that a governance function can accept. Systems connect over a REST integration API under scoped, grant-gated credentials. A person, an agent and a system therefore walk through the same door, and the audit trail records who.

Two further properties round out what a CIO can own. /TRUTH runs as a dedicated instance for your organisation; the material and the claims distilled from it stay there. And every topic a person can access can be exported whole, as complete JSON, claims included, so the knowledge estate you build is yours to take elsewhere. There is no lock-in, which is a governance property as much as a commercial one: an estate you cannot leave is an estate you do not own.

6. What a CIO can now own

Put the four properties back together and the second estate becomes something a CIO can actually be accountable for. It is sourced: every statement points at where it came from. It is permissioned: who may read it is decided per project and enforced for people and agents alike. It is auditable: supersession and conflict are recorded, not remembered, and every answer carries its sources. And it is current: a newer source supersedes an older one on the page, and watch lists and a change digest report what changed and what now conflicts.

This is not a search product over the shared drive. Search returns files and leaves you to read them; it does not know that two of them disagree or that one replaced the other. It is not a summarization layer either; a summary without provenance is a confident paragraph with no way to check it. It is governance, applied to the estate that was never governed, using the same four properties the operational estate already has.

Bluestaq runs its own company strategy on /TRUTH, and the product is in continuous use at Bluestaq. It is one of four equal products, with /MARKET, BLUESTAQ /ARQ^™ and /LAUNCH, on one secure, open platform.