Picture a contract that exists in three places. There’s the draft sitting in someone’s email, the version a colleague saved to a shared drive, and the signed copy legal filed somewhere else entirely. A person usually knows which one counts. An agent doesn’t. It grabs whichever one it finds first, and it sounds just as sure of itself either way.
That was the problem Aaron Levie kept coming back to at BoxWorks in San Francisco this week. His argument is that models know an enormous amount about the world and almost nothing about your business. What they need to know lives mostly in unstructured content, which he put at about 90 percent of a company’s data. It’s in the roadmaps, the projections and the contracts, and it’s scattered across more systems than anyone can keep straight. Box wants to be the place agents go to find the right version. It described itself as the secure content layer underneath the whole AI stack.
Regular readers will know I’ve been making a version of that case for over a year under the name Universal Context Layer. This fall, almost everyone has landed somewhere nearby. Zoom started from conversations, Zoho from business definitions, and Oracle from what it calls a system of context. Box starts from the files. I’m writing a separate piece on what that convergence means, so I’ll leave it there for now.
Finding the right page
The headline announcement was Box Context Retrieval, built with NVIDIA’s Nemotron retrieval models. Rather than handing an agent a stack of documents, it finds the passages that actually answer the question. It keeps its index current as files change, and it works inside the permissions already set in Box. Box claims at least 20 percent better accuracy, roughly 90 percent fewer input tokens, and answers up to four times faster. Those are Box’s own figures, and I’d like to see them hold up in a messy real world environment. It’s expected to be generally available early next year for Enterprise Advanced customers.
The more ambitious idea was Box Architect, shown as a sneak peek and due in beta this quarter. You point it at a set of content and an existing process, and it proposes a redesigned workflow, builds it and keeps adjusting it over time, with a person approving the changes. Box Mount, meanwhile, lets agents working in separate sandboxes share one Box folder that stays in sync, and it flags the conflict when two of them change the same thing.
Keeping score on the agents
Where Box stood out was in how seriously it took governance. Admins can keep agents away from files classified as sensitive. They can stop an agent from deleting content or writing into a folder shared outside the company, and they can trigger an alert or a block when an agent’s activity crosses a limit. The audit trail is designed to show which agent acted, who it acted for, what it touched, and what it produced.
The roadmap session added something worth paying attention to. Box plans to put agent sessions under the same retention, legal hold, and disposition rules as the content they touched. Microsoft and Google already do something similar for their own assistants’ conversations. What’s different here is that the record of what an agent did sits right next to the files it worked on, so you can keep, search, and defend it just like a contract. When something goes wrong, and you need to reconstruct what happened, that’s exactly the piece you’ll want. It’s also one of the nine questions I ask of any context layer, and Box is building for it directly. That’s a meaningful step.
The part still being worked out
Two things I’m still thinking through with Box. The first is identity. The phrase I heard again and again was that your permissions go with the agent. That’s a sensible default, and it also means the agent is acting as you, not as itself. Box mentioned connecting AI apps through the company’s identity provider next year, and that’s where a distinct agent identity would have to come from.
The second is what happens after the door opens. Box can decide whether ChatGPT or Claude is allowed to read a file. Once that content is sitting inside the assistant’s context, though, it isn’t obvious that Box’s rules follow it there.
Then there’s a question Jensen Huang raised without quite meaning to. Levie asked him why engineers who use agents seem busier than ever, when AI was supposed to free up their time. Jensen said the agents keep coming back with results, and every one of them has to be evaluated, so the number of evaluations is growing exponentially. I’ve been calling that the Friction Tax. The time an agent saves doesn’t vanish. It shows up again in the review process.
You could see the other side of it in Samsung’s vendor-risk workflow, one of the strongest customer stories of the day. An agent scores each new vendor, and the low-risk ones skip human review altogether. That’s a real saving. It’s also a check a person used to make and no longer does. Box is adding human checkpoints for what it calls impactful agent actions later this quarter, and Architect will be suggesting which steps a process keeps. Deciding what counts as impactful may turn out to be one of the most consequential settings a company chooses this year.
Mike Krieger of Anthropic Labs, who closed the event, explained why that choice matters. When software becomes cheap to build, he said, what stays scarce is taste, attention, accountability and ownership, and those still belong to people. Claude had been on stage earlier too, running on Box content for the consulting firm BTS, which makes BoxWorks the fifth vendor event this fall where Anthropic’s model sits underneath someone else’s agent.
Levie’s favorite line of the week was that the future is files. I’d add one thing. The files that matter most may be the ones that record what the agents did with all the others. Box is building for that, and it’s further along than most in my opinion.
