I have never been a note-taking person. For years my notes were a place to put things so I would not forget them — no linking, no structure, none of the productivity machinery people build around Obsidian, and that has not changed. What changed is that since May 2026 a Claude agent has read and write access to the notes-vault, and it does that part instead of me: personal notes, projects, basic planning. I talk to it in a Discord channel.
Some evenings I type «Добраніч» — good night — into that channel, and my notes tidy themselves up while I go to bed. Some evenings I forget, and the next morning I type «Добраніч і добрий ранок» in a single message: good night and good morning, closing a day I never closed and opening the one I am in. The agent answers that it has queued a save and a health check. A couple of minutes later the results come back — what it filed, what it cleaned, what it found wrong.
To work from one word, the agent holds keys to everything I have written: it can write anywhere in the vault, and it never asks permission.
I did not build the structure
The obvious defence of that arrangement would be that I designed the vault carefully enough to survive it. I did not. The folder map, the naming conventions, the rules about what gets saved without asking and what has to be confirmed, the instruction file the agent reads before it touches anything — all of it was generated for me by obsidian-second-brain, an open-source skill that bootstraps exactly this setup. The convention that every note opens with a short block addressed to the next session came with it too. I did not write those rules. I accepted them.
What I wrote myself is one line of frontmatter:
layer: legacy # the frozen thing that exists today
layer: target # the thing being built to replace it
One of my projects is a rewrite: an older version that still runs, and a successor that is replacing it piece by piece. Both are described in the same vault, in notes that use the same words for different things — the old one passes shopping lists through to an external service, the new one keeps its own table. Nothing had gone wrong. It just seemed obvious that a search across both would eventually return the old design as an answer about the new one, so I tagged every note with which world it belongs to, and wrote down the rule that goes with the tag: when reasoning about the successor, treat the old notes as evidence about the present, never as a description of the target.
So my one contribution to the structure is not structure. It is a fence: a place where I decided in advance that the agent would be wrong, and took that ground away from it beforehand.
The channel is the whole product
An assistant I have to go somewhere to use is one more thing on the list of things to do, and what I do with lists like that is established. The part that makes this work is not the model or the vault. It is that talking to it costs nothing.
It lives in a Discord channel, chosen from two directions. I do not trust Telegram enough to route my notes through it. And Discord is the one messenger with a simple, official plugin for the agent — I did not have to write a bridge, maintain it, or trust my own bridge with the same keys. Fewer moving parts I own is itself a security position.
What goes through that channel during a day is not the tidy version. Ideas thrown in as they arrive, feature arguments about Pantensa, the product I am building, design generation, planning, personal things that have nothing to do with code. «Добраніч» is not the interaction — it is the closing command that files whatever the day produced.
Two things the polished version of this setup would leave out.
Writing to the vault is easier than reading it. There is an Obsidian app on my phone, but keeping a git-synced vault working there was more setup than I wanted, so I never finished it. When I actually need a full note away from my desk, I open the repository on GitHub and read the markdown there. The agent has better access to my notes on the move than I do.
And voice. Discord voice messages transcribe locally through a self-hosted speech model: record, transcribe, confirm the transcript, run the task. I built it, debugged it, and then never used it — dictating turned out not to be my way of thinking. It sits there, working, unused. I am keeping it, on the theory that the person who wants it later is me.
Why it needs the keys
An assistant that only appends could ask permission. Appending is safe: worst case the vault grows a note nobody reads. What this one does instead is edit what is already there. New information does not land at the bottom of a file as another entry — it goes back into the note that is now wrong, marks the superseded part as superseded, and leaves the correction where the next reader will hit it. A note in my vault about a piece of infrastructure carries a line saying the architecture below it was confirmed on a date, and that the recommendation above it is dead. I did not write that line. The agent wrote it over its own earlier advice.
That is what I want, and it cannot run behind a confirmation prompt. A prompt per edit turns a two-minute cleanup into a queue of yes, and I would stop within a week — the same way I stopped with linking, with tags, with every other habit this system exists to work around. The permission is not a shortcut. It is the feature.
Which leaves the real question: what happens when it rewrites them wrong.
Worth it for now
So far it has not. Nothing has been destroyed, nothing important has quietly turned into something false that I later acted on. That sentence is weaker than it sounds: I do not audit the vault. I do not read back what the agent filed to check it. I notice problems the way anyone notices problems in a tool they use daily — when something I need is not where it should be — and that has not happened. That is not the same as verified.
The technical fence is real. Everything runs in one container that has the vault and nothing else, the vault is a git repository, and every edit the agent makes is a commit I can read or revert. That is the part I would point at if someone asked whether this is reckless.
It is not the part that actually holds. The vault was never my source of truth — it is an assistant. Things I genuinely cannot afford to lose or to have subtly rewritten do not live there — they are in a plain notebook, sometimes duplicated into Obsidian and sometimes not. I never decided that as a policy. I noticed it as a fact, and only while writing this. The agent has keys to everything in the system, and what makes that survivable is that I never put everything in.
The leak I know about is not in the vault. Running an agent with permission prompts disabled means the channel that talks to it is a channel that runs commands. Everything above about the agent being trustworthy assumes the only person typing into it is me, and that assumption holds because of how the box is reachable, not because of anything the agent enforces. Reachability rots quietly: a line in a compose file that publishes a port instead of keeping it on an internal network looks almost identical to the line that does not. I know where mine is. I have not changed it.
So: an agent that can rewrite anything I have written, that never asks, that I do not audit, on a box whose boundary rests on an assumption I carry rather than enforce. Against that, the only system of notes I have ever kept for more than a month — because the part I was never going to do is done by something that does not get tired of doing it.
Worth it for now, and «for now» is the term of the deal, not a hedge. It holds while the vault stays the assistant and not the record, while the box stays unreachable, while nothing in there is something I cannot lose. Three separate things that can each stop being true, and none of them will announce it.
Top comments (0)