The issue is when users interact with claude, what can they see? If the AI can see super-secret-payroll-details.md - is it allowed to discuss that with any user? is there some sort of internal ACL within claude that asks pretty please don't tell everyone they're underpaid?

That's why multiuser agents can be an issue.

The other way to do this, is to have claude installed for everyone, and any user's chat with claude uses their personal permissions via something like oauth delegation or AWS IAM role kinda things. But that, again, is complicated ACL logic living through the delegation of roles and access

I'm not sure the permissions problem is solved even if we assume models inherit user permissions. Imagine I'm a manager and someone contacts me about an HR incident involving one of my reports, or other sensitive information. The agent probably shouldn't have access unless I explicitly provide it.