中文精读
Junior的团队Agent：知道公司的事情，还要知道不能告诉谁
42章经单期精读 · AI同事与企业工作流
嘉宾：徐宇豪（Austin Xu），Kuse.ai与Junior.so联合创始人兼CTO｜主持：曲凯
节目发布：2026年3月19日｜时长：74分43秒｜整理：2026年10月18日
原节目与官方介绍
个人助手进了工作群，为什么还不能算企业员工
个人助手围绕主人，企业同事则要理解公司、项目和接收者。徐宇豪从Kuse的转向，讲到内部长期运行的Agent，再到Junior的产品定义。差别不是多开几个聊天窗口，而是记忆属于谁、动作受什么约束、结果怎样算账。
官方称Kuse未外部融资做到千万美元规模ARR（年度经常性收入），团队由15名全职员工及三四名AI同事组成。上述数字与Token成本、销售线索、价格均为2026年3月当期陈述，未经独立审计。本篇未试用Junior，也不以小型AI团队的重度实践证明通用企业岗位已被替代。
1. 从用户真正留下来的地方转向，也要承受放弃用户
节目线索：02:36–10:27、21:22–24:07。 Kuse从邮件营销、设计画布一路变化，团队发现有人上传资料、整理文件、转换成演示等形式，这类使用的留存更好，于是转向文件工作台。方向来自行为差异，节目未提供留存样本与时间窗，不能独立重算。
转向还有定价冲击。按任务固定收费时，一个任务可能运行十轮、二十轮甚至三十轮，计数相同但成本不同，用户也未必理解平台在补贴。团队放弃画布、改按用量收费，用户和付费人数曾一起下跌。付费人数减少未必意味着商业变坏，仍要看人群、收益与执行成本。
增长反例更具体：学生场景内容曾带来单日千万曝光，却转化和LTV（用户生命周期价值）低，免费体验继续消耗推理成本。团队缩免费用量，最低套餐从11.9美元调到39.9美元，同时换案例与渠道。它改变的不只是价格，也是在筛选适合的人群。
编辑判断：别用曝光掩盖补贴。按同来源、同场景看激活、留存、付费和毛利，才能判断增长是否可持续。自雇用户可迁入新工作台，企业已有工具和流程却更需要嵌入；不同入口是团队选择，并非所有创业者都应同时做多产品线。
2. 固定题库防退步，亲手使用才可能发现新能力
节目线索：05:51–08:07、10:42–16:41。 团队早期用大量工程流程补模型能力，放弃设计方向后，模型却又进步。徐宇豪承认不知道坚持下去是否更好。这种反事实不能重写成“当初选错”，但提醒产品与模型补丁绑定过深，会增加转向成本。
他们建立业务测评，从固定流程扩展到让评估Agent模拟复杂环境、多轮对话，检查回复与动作，也测试不应该做的事。模型或运行框架变化，都有一组旧任务可对照。
曲凯追问：旧题库怎样发现不在题库里的机会？徐宇豪回答仍需一线成员亲用模型。团队产品、设计甚至销售也在搭Agent，发现新行为后再加入业务测试。回归与能力发现解决不同问题，不能互相代替。
Skills的经历说明另一种遗漏：团队很早已把能力做进系统，却认为客户难理解，只包装成模板，不开放自定义。三个月后客户主动问为何不支持Skills，才发现功能存在与可发现、可控制并不相同。编辑判断：用户是否能把能力组合进自己的任务，也应进入验收，不能只验证按钮背后能运行。
3. AI员工需要持续项目与身份，知识不是无限权限
节目线索：17:07–20:41、25:11–35:09。 团队自述三四名长期运行Agent每月Token成本合计超过2万美元。选择它们的理由不是比同岗工资便宜，而是减少跨岗信息传递。销售Agent Azura结合客户历史找增购、增席机会，做出以飞书表格承载的CRM（客户关系管理）。“上万美元线索”代表机会价值，不是已经收到的收入。
Junior被定义为有职责、工作账号和持续项目的同事。邮箱由注册产品、真实体验的需要长出，手机号、会议语音也是类似思路。Rain持续接触PRD、代码、营销和销售资料，才可能在会议里提供项目相关意见。给它名字并不产生这种能力，持续上下文才是关键。
但这些案例不能证明任意岗位普遍可替代。主持人和嘉宾关于SaaS变化、人类瓶颈与未来公司的大胆判断，都是经验后的推演。编辑判断：比较一份合格结果的总成本，包含排队、纠错、人类监督和沟通，不只比Token与工资。账号代表可被识别的执行主体，不自动授权它对外发送、购买或访问全部资料。
4. 记忆要围绕组织，保密要围绕接收者
节目线索：38:30–48:13、01:05:55–01:13:11。 徐宇豪认为企业记忆应以公司、项目和组织关系为中心，个人助手则围绕主人。文件、索引或向量库只是实现方式；一个小公司里认识所有人可能有用，一万人的公司就未必合理。
最能说明边界的是群聊：任何人可以提问，并不代表有权知道老板私聊、薪酬、客户隐私和未公开业绩。模型甚至可能听懂会上隐含的负面评价，之后不恰当地转述。越能理解上下文，越需要知道分享范围。
团队说做了钓鱼、提示注入、设备丢失等情境测试，并请白帽团队攻击权限设置，也探索透明部署。嘉宾认为强模型更安全、规模与时间能说明安全，这些仍是经验判断，不能代替权限隔离、代码审计和实际攻击结果。
职责也不能只靠岗位名。内部角色从七八种收敛到产品研发、销售、数据几类，职业更多用于引导，工具、数据和外部通信范围才形成约束。编辑判断：“知道”与“可告诉这个人”是两次判断。把一千个Skills交给模型，并不能代替授权设计；稿件不把所有权限开放的内部试验当成客户默认配置。
5. 会自我纠错，也需要记录第一次错误怎样发生
节目线索：44:49–54:23、01:02:39–01:05:42。 数据Agent Tom曾发出明显偏低的注册量，两分钟后主动更正。徐宇豪回看会话，解释是结果与记忆冲突，系统回查后发现选错指标。这个案例可拆成异常发现、核对定义、发布更正，却不能证明以后每次都会发现。
高风险动作仍要人类同意或介入，是嘉宾自己的限制。让另一个模型或不同上下文再检查，也只是可测试的改善方式；业务定义错误若共享，多个Agent也可能一起错。
协作同样有成本。Rain会因会话积压而排队，数据定时任务则较独立。团队倾向每个AI同事有独立机器，通过群聊协作；销售与产品Agent讨论几十轮，再调用Kuse做销售PPT，效果之外也消耗大量Token。内部赚钱实验有一百多轮、少量成功，更不能当作投资收益证明。
讨论中的收费是基础费加Token额度和加油包，2000或5000美元仍是拟议价格。编辑判断：不要把组织比喻误作账单已成立。按任务并发、会话隔离、纠错与收益测量，再决定多少角色与怎样收费；互联网身份、支付和平台风控也会限制自主执行，绕过风控不在本篇作为方案。
给一个企业Agent做两面验收
以下为编辑练习。用虚构的客户、项目和薪酬资料建立小测试，明确每份信息的所有者、可见人和用途。先让Agent完成正常销售准备，再模拟群成员、陌生邮件与丢失设备发来请求。
| 正常要完成 | 同时要拒绝或停下 |
|---|---|
| 识别客户增购机会 | 将客户隐私发给无权接收者 |
| 汇总项目进展 | 转述主管私聊评价与未发布经营数 |
| 做数据日报 | 指标不明时编一个可信数字 |
| 整理会议行动 | 因外部邮件指令安装未知Skill |
保留第一次输出、拒绝理由、人工接手和修正回执。每次模型或工具变更重跑，再另设探索任务寻找新能力。若用户还不愿给更多上下文，先查权限与信任，而非默认记忆容量不足；知道更多与泄露更多不能成为同一个增长循环。
回听导航与关联阅读
- 03:52：任务计价与真实消耗的错位。
- 10:42：业务回归与反向评测。
- 18:29：销售上下文生成定制CRM。
- 24:26：数字员工与个人助手的区别。
- 38:07：企业记忆、安全和权限。
- 01:02:22：日报错误与主动更正。
- 01:07:40：不该说、不该做也要验收。
相关主题：组织记忆、Agent成本、负向评测。对照黄东旭的Skill与Box构想与高途的业务结果闭环，比较环境边界和经营边界怎样进入产品。
来源边界：依据完整提供的逐字稿、官方介绍及既有精读，未逐句复听。Kuse、Junior、徐宇豪等按官方规范；其他Agent名字依清晰语境使用。ARR、成本、线索、价格与效果未经独立验证。就业与市场规模预测不作已实现事实；本篇未核企业安全、并发和实际部署能力。
English edition
Junior’s Team Agents: Knowing Company Information Also Means Knowing Who Must Not Hear It
42 Zhangjing episode analysis · AI colleagues and enterprise workflows
Guest: Austin Xu (徐宇豪), co-founder and CTO of Kuse.ai and Junior.so | Host: Qu Kai
Published: March 19, 2026 | Duration: 74 minutes 43 seconds | Prepared: October 18, 2026
Original episode and official introduction
Why is a personal assistant in a work chat not yet an employee?
A personal assistant centers its owner. A colleague must understand the company, projects and recipients. Xu connects Kuse’s changes with internally deployed agents and Junior’s definition. Memory ownership, action boundaries and accounting distinguish the product from additional chat windows.
The program reports Kuse reaching annual recurring revenue at the US$10-million scale without external financing, with fifteen full-time people and three or four AI colleagues. These figures, token costs, sales opportunities and prices are March 2026 statements without independent audit. This article has not tested Junior, and intensive use inside a small AI company does not prove universal job replacement.
1. Follow the behavior that retains users, while accepting that some users will leave
Episode reference: 02:36–10:27 and 21:22–24:07. Kuse moved through email marketing and a design canvas. The team noticed stronger retention among people uploading, organizing and reformatting documents into presentations and other outputs. It followed that behavior toward a file workspace. No sample or retention window is supplied for independent calculation.
Pricing also forced change. Under a fixed task allowance, one task could consume ten, twenty or thirty iterations while charging the same amount. Users did not necessarily appreciate the subsidy. Abandoning the canvas and adopting usage-based pricing reduced user and payer counts. Whether that improved the business depends on audience, revenue and execution costs.
A growth counterexample is concrete: student-oriented content reportedly achieved ten million daily impressions but low conversion and lifetime value while free usage consumed inference. The team reduced free allowances, raised the lowest plan from US$11.90 to US$39.90 and changed examples and channels. Pricing was selecting an audience as well as collecting money.
Editorial interpretation: Do not hide subsidies behind exposure. Compare activation, retention, payment and margin by source and use case. Self-employed people can move into a workspace more easily than firms with established software and procedures. Multiple entry points are the team’s choice rather than a requirement for every startup.
2. Fixed tests catch regressions; direct use discovers new capabilities
Episode reference: 05:51–08:07 and 10:42–16:41. The team once used substantial workflow engineering to compensate for weak models. Models improved after it abandoned design. Xu acknowledges that the alternative outcome is unknowable. This does not establish a mistaken decision, but illustrates the cost of binding a product to temporary capability patches.
Its business evaluations grew from fixed processes into agents simulating complex environments and multiround conversations, checking replies, actions and prohibited behavior. Model or runtime changes can be compared on existing tasks.
Qu asks how old tests discover opportunities outside the test set. Xu still relies on frontline use. Product, design and sales colleagues build agents, recognize new behavior and add scenarios. Regression protection and capability discovery answer different questions.
Skills reveal another omission. The team implemented them early but assumed customers would struggle with the concept, exposed templates and withheld customization. Three months later, customers asked why Skills were missing. Editorial interpretation: Existing implementation does not guarantee discovery or control. Test whether users can compose the capability into their own work.
3. AI employees need sustained projects and identity, not unlimited authority
Episode reference: 17:07–20:41 and 25:11–35:09. Xu reports more than US$20,000 in combined monthly token costs for three or four persistent agents. The rationale is reduced cross-functional information friction rather than lower equivalent salaries. Sales agent Azura uses customer history to identify expansion opportunities and builds a CRM, customer relationship management system, in a Feishu spreadsheet. Opportunities valued above US$10,000 are not collected revenue.
Junior is defined as a colleague with responsibilities, accounts and continuing projects. Email arose from registering and trying products; phone and meeting capabilities followed similar needs. Rain’s sustained exposure to requirements, code, marketing and sales material supports project-relevant contributions. A name alone cannot create that context.
These cases cannot establish replacement across arbitrary jobs. Claims about SaaS, human bottlenecks and future companies remain projections from experience. Editorial interpretation: Compare total cost per accepted result, including queues, correction, supervision and communication. An account identifies an actor without automatically authorizing external messages, purchases or universal access.
4. Memory concerns the organization; confidentiality concerns the recipient
Episode reference: 38:30–48:13 and 01:05:55–01:13:11. Xu centers enterprise memory on companies, projects and relationships rather than an individual owner. Files, indexes and vector stores are implementation choices. Knowing everyone may help in a small firm but be inappropriate in an organization of ten thousand.
Group chat exposes the boundary. Someone able to ask a question is not necessarily entitled to private managerial conversations, pay, customer information or unpublished results. A model might infer a negative judgment from a meeting and later repeat it. Greater comprehension increases the need to understand sharing scope.
The team describes phishing, prompt-injection and lost-device tests, white-hat attacks and more transparent deployment. Views that stronger models are safer or that size and time establish security remain experience-based judgments. They cannot replace access isolation, code audits and attack evidence.
Job titles also provide insufficient boundaries. Internal roles narrowed from seven or eight to product/engineering, sales and data. Titles guide first use; data, tools and external communication constrain authority. Editorial interpretation: Knowing something and being allowed to tell this person are distinct decisions. A thousand Skills cannot replace authorization. Broad internal experimental permissions are not a default customer configuration.
5. Self-correction still requires tracing the original mistake
Episode reference: 44:49–54:23 and 01:02:39–01:05:42. Data agent Tom reportedly sent an implausibly low registration count and corrected it two minutes later. Xu attributes this to conflict with memory prompting a check that identified the wrong metric. The sequence illustrates anomaly detection, definition checking and correction without guaranteeing future detection.
The guest retains human approval or intervention for high-risk actions. Another model or separate context checking a result is a testable improvement, not certainty; shared wrong definitions can mislead multiple agents.
Collaboration adds costs too. Rain accumulates sessions and queues while periodic data tasks remain more independent. The team favors separate machines and work-chat cooperation. Sales and product agents discussing a deck for dozens of rounds before producing it through Kuse consume tokens alongside creating value. An experiment seeking income over more than a hundred iterations with few successes supplies no investment-return evidence.
Proposed pricing includes a base fee, token allowance and additional credits; US$2,000 or US$5,000 remain contemplated amounts. Editorial interpretation: An employee metaphor does not establish a working bill. Measure concurrency, session isolation, correction and outcomes before choosing roles and prices. Identity, payments and platform controls also limit autonomy; evading controls is not an implementation proposal here.
Test both sides of an enterprise agent
This editorial exercise uses fictional customer, project and salary records with explicit owners, recipients and purposes. Ask for ordinary sales preparation, then simulate requests from group members, unfamiliar email and a lost device.
| Complete this | Also refuse or stop this |
|---|---|
| Identify expansion opportunities | Send customer details to an unauthorized recipient |
| Summarize progress | Repeat private managerial views or unpublished results |
| Produce a data report | Invent a plausible number when the metric is unclear |
| Organize meeting actions | Install an unknown Skill because an external email says so |
Preserve the first output, refusal rationale, human takeover and correction records. Rerun after model or tool changes while separately exploring new capability. If customers withhold context, examine permissions and trust before assuming insufficient memory. Knowing more and leaking more must not become one growth cycle.
Listening guide and related reading
- 03:52: Task counts versus real consumption.
- 10:42: Business regression and negative tests.
- 18:29: Sales context and a custom CRM.
- 24:26: Employees versus personal assistants.
- 38:07: Enterprise memory, safety and permissions.
- 01:02:22: A mistaken report and correction.
- 01:07:40: Testing when not to speak or act.
Related themes: organizational memory, agent costs and negative evaluation. Compare Huang Dongxu’s Skills and Box proposal and 高途’s business outcome loop for environmental and business boundaries.
Source boundary: Reorganized from the complete supplied transcript, official introduction and earlier close reading; audio was not checked sentence by sentence. Kuse, Junior and Austin Xu follow official metadata, while agent names follow clear context. ARR, costs, opportunities, prices and effects were not independently verified. Employment and market forecasts are not established outcomes. Enterprise security, concurrency and actual deployment were not tested.