Glean: The Key to Enterprise AI Search and Agents

I got access to Glean about two months ago. It is the first thing I open now.

Before that, a normal morning meant seven tabs: Gmail, Salesforce, Google Docs, Highspot, Slack, my AI platform of choice, and whatever proposal I left half-finished the night before. The information I needed was always somewhere in there. Finding it was the job. I knew a pricing detail lived in a Doc, that the relevant back-and-forth never fully made it into the CRM, that a competitor note was buried in a Highspot deck I last touched in March. So I went and got each piece by hand, one tab at a time. Hunting down each item was supposed to be something AI eliminated.

Most enterprises have decided that AI adoption is the priority. The hard part is rarely the decision. The hard part is too many cooks in the kitchen, and no one decides which process is best. Everyone has their favorite models or tools, too many people use them in too many ways, and compliance is never met. An LLM is only as good as the context it can see, and the easiest way for an employee to feed it that context is to paste company work into a personal ChatGPT or Gemini account. That solves their afternoon and creates a problem nobody can audit. My company took a different route. They put Glean in the middle.

The First Thing Glean Did Was Stitch My Week Together

The pitch for a tool like this is “enterprise search,” which undersells it. The first useful thing it did was answer a question I would normally have spent twenty minutes reconstructing across systems. It pulled the thread of an account through Salesforce, the email chain that explained the account, and the Doc where I had drafted the actual numbers, then handed me the summary I was going to assemble myself.

At some point, I had to stop and ask what it was even looking at, because it clearly was not just one system. It was reading across the same stack I click through every day: the Docs and Sheets where proposals and pricing live, the Gmail threads that hold the context CRM never captures, the Salesforce records, the Slack conversations, the internal documentation I forgot existed. Everything I already use is in one place, finally able to talk to each other.

What Enterprise AI Search Actually Sees

The question that follows is the one a security team asks first. How is it seeing all of this, and what is it doing to my data?

The answer is duller than people expect, which is exactly why it works. Glean connects to each source system and indexes the content, the titles, the metadata, and the timestamps. Alongside the content, it pulls the permission map from every source: the access-control list that says who is allowed to see each file, channel, and record. Here is the part I think about most. If I do not have access to a document in Google Drive or a channel in Slack, it never appears in my Glean results and never lands in an answer it writes for me. The tool stays compliant by inheriting the walls that already exist. It does not knock any of them down.

The indexing itself is read-only. Glean reads from the source systems to build its understanding; it does not reach back in and change your Salesforce records while it crawls. There is a nuance here worth being precise about, because it is the kind of thing that gets repeated wrong. Glean can take write actions, creating a ticket, updating a record, posting a message, but only when an administrator explicitly enables that capability, usually behind a confirmation step, and always inside your existing permissions. Reading is the default. Acting is a door someone has to deliberately open. I will come back to that, because I decided against it.

Then I Built an Agent

A few weeks in, I stopped just searching and built one of Glean’s agents. The job was narrow: take a company and a contact, research them, and draft a first outreach email in my style. Simple enough to describe. The interesting part was that everything I made it check before it was allowed to write a single word.

Take a fictitious example. Say I want to reach the Chief Compliance Officer at Meridian Trade Finance, a commodity lending firm. Call her Sarah Vance. I hand the agent the company and the contact, and the first thing it does is decide whether I am even allowed to talk to them.

I started the test with Meridian, headquartered in Houston. The agent checked the company against the do-not-call list, came back clear, then checked the territory assignments and stopped. Houston belongs to another rep, not me. No draft, no argument, just a hard halt at the boundary. That is the gate working exactly as designed. I moved the fictional firm to Detroit, which sits in my territory, and ran it again.

This time, it cleared both checks. Not on the do-not-call list, Michigan is mine, company verified, single standalone entity with no parent to route around. Only after all of that does it look for a credible reason to reach out, pulling recent public news from web search rather than inventing one, and falling back to a clean non-news opening when nothing strong exists. Every step runs on my permissions, so it can only ever build an email from material I could already see myself.

Then it picks the angle. A compliance officer at a trade finance firm does not lose sleep over the same things a marketing lead does, so the agent reasons from the title and the industry to the actual pain: sanctions screening and beneficial ownership on cross-border commodity deals, where the counterparty, three steps down an ownership chain, rarely shows up in a standard watchlist check. That becomes the opening line. One design choice shaped the rest of the draft. I told it not to lead with product names. A cold email that opens with an internal acronym is a cold email that gets deleted, so the agent leads with the problem and the outcome and treats the product as the thing that gets you there.

Here is the part I think about most. I gave it the ability to research, reason, and draft. I did not give it the ability to send. No automatic Gmail draft, no outbound anything. The email lands in front of me and stops, exactly as it does in the screenshot above. The platform would let me wire in that final step; the write action is right there. I chose not to. That choice, more than any feature, is what makes this usable inside a company that has to answer for everything its people do. The agent handles the tedious work and leaves the decision that carries risk to me.

Picking the Engine

There is one more thing that changed how I think about all of this, and it has nothing to do with search. When I build an agent, I choose the model. A dropdown gives me reasoning mode and a list of frontier LLMs, the latest Claude, the latest GPT, the latest Gemini, sitting next to each other as interchangeable parts. I personally prefer Claude, but I can route a drafting task to one and a reasoning task to another, and swap them when a better one ships next quarter.

That quietly inverts the usual relationship. Most coverage treats the model as the product and everything else as plumbing. Inside a system like this, the model is the commodity, and the layer around it, the permissions, the connectors, the governance, the place where my work actually lives, is the thing that holds. The labs can keep racing. The layer stays put.

The Quiet Part

The strange thing is not that a tool like this exists. It is that almost everything it draws on has been sitting in those six tabs the entire time, behind permissions that were already correct, waiting for something to read across them at once. The hard problem of enterprise AI was never really the intelligence. It was the access, the audit trail, and the question of who is allowed to do what.

So the question I keep landing on is not whether my company should have adopted AI. That decision made itself. It is the quieter one underneath: once a system can see everything you can see and act on your behalf the moment you let it, how much of that last step do you actually want to hand over?

Frequently Asked Questions

Does Glean respect existing permissions?

Yes. Glean reads the access-control list from each connected system alongside the content, so it enforces the permissions that already exist in the source. If you cannot open a document in Google Drive or read a channel in Slack, it will not surface in your results or in an answer Glean writes for you. It inherits the walls already in place rather than building new ones.

Does Glean store a copy of my company’s data?

Glean indexes content from connected systems to make it searchable, and the indexing is read-only: it reads from the source to build its understanding without changing the underlying records. For some systems, it can also fetch fresh data at query time rather than relying only on the indexed copy. Anything stored sits behind the same permissions as the original.

Can you choose which AI model Glean uses?

When you build an agent, yes. The setup lets you pick a reasoning mode and select from current frontier models rather than being locked to one. That means you can route different tasks to different models and swap them as better ones ship, which is one of the reasons a layer like this ages better than any single model underneath it.

Can Glean take actions, or does it only search?

Both, depending on how it is configured. Search and indexing are read-only by default, but Glean can also take write actions, creating a ticket or updating a record, when an administrator enables that capability, usually behind a confirmation step and always inside your existing permissions. Acting is a door someone has to deliberately open, which is why I left it closed on the agent I built.