March 1949. That's when they finally took the gate down at Oak Ridge, Tennessee. A city of seventy-five thousand people, the fifth largest in the state, and for six years it had not appeared on a single official map.
And the people living in it mostly had no idea what they were building. So when Daniel sends us a prompt asking what would happen if a normal company ran on need-to-know doctrine, the honest answer is: we don't have to imagine. We ran the experiment. It was a city.
Daniel's pitch is a Netflix concept, and the premise is simple. Take compartmentalization, take need-to-know access, everything we've talked about when intelligence tradecraft bleeds into civilian cybersecurity, and strip out the national security justification. Then run an ordinary company on it. The end product is a workplace where nobody really understands the purpose of their own workload. You can't discuss what you do with the person at the next desk, because there's an information-sharing boundary. And your only feedback comes from a middle manager whose identity you may never learn. He wants to know what a typical day looks like, what retention looks like, how fast the culture leaks onto recruiting forums even with airtight NDAs, what the unexpected upsides are, and what internal culture develops when every worker is a workflow island.
And the good news is we don't have to imagine from scratch, because there's a real precedent, and it's a city.
Let's define the two doctrines first, because the thought experiment only has sharp edges if we're precise. Compartmentalization is splitting information into isolated cells, so that access to one cell tells you nothing about another. Need-to-know is the grant rule: you get access only if you require it for a specific task, not because of rank or seniority.
And here's the distinction the whole episode turns on. In intelligence work, compartmentalization has a justification. A leak can get people killed. An agent's identity in the wrong hands is a death sentence. So you accept the friction because the cost of the alternative is measured in bodies.
In a civilian company, that justification is absent. There's no agent whose life depends on the org chart being opaque. So what remains is the architecture without the reason. The walls, minus the thing the walls were for.
Which is why this is such a good thought experiment. Modern corporate training treats silos as a pathology. Every management book, every onboarding deck, every internal comms strategy is explicitly designed to eliminate the silo effect. Daniel is proposing the deliberate inversion. Silos as policy, not as failure.
One honest caveat up front, before we build this out. Nobody has found a standalone company running the full extreme. No firm where no employee understands the company's purpose, colleagues are barred from discussing work, and managers are anonymous. The closest real analogues are the Manhattan Project sites, which were government projects, and partial-secrecy firms like Palantir, Apple, SpaceX, Tesla, and the AI safety startup Conjecture. All of those still tell employees their broad mission.
So the pure version stays hypothetical. But every component of it has been run somewhere, and we know what happened.
Oak Ridge.
Built for the Manhattan Project, seventy-five thousand people, gated until March 1949. And the striking thing is how ordinary the secrecy was. It wasn't dramatic. It was administrative. You got a job, you got a badge, and you were told nothing.
Bill Wilcox's job interview is the whole system in one exchange. He asked what he'd be working on. The answer was: "No, can't tell you. Secret! Secret, secret, secret!"
Three secrets in a row. That's not a security briefing. That's a man being told the concept of information has been withdrawn.
What did the actual days look like?
Mary Anne Bufard worked in a laundry. Her job was counting uniforms. She held each one up to an instrument, and if she heard a click, she threw it back. That was it. She was screening for radiation contamination, and she did not learn that until after the bomb was used.
She was listening for a click for years and nobody told her what the click meant.
Bill Ragan is the other one. He watched a dial move from zero to a hundred and turned a valve. All day. For three years. His line was, "It got so I was doing it in my sleep."
That's the answer to Daniel's first question, what a typical day looks like. The work is real. It's repetitive. And it's been stripped of meaning on purpose. The worker performs a task whose purpose is structurally withheld.
And that's not a side effect. That's the design. You cannot tell the valve-turner what the valve does, because the valve-turner talks to his wife, and his wife talks to the neighbor.
So what happens to morale? Because that's where Daniel's retention question actually lives.
Oak Ridge kept records, and they're brutal. The Recreation and Welfare Association wrote this: "Due to the secrecy surrounding the nature of the Project, he never saw the results of this labor. There was nothing in which he could take pride... No sense of satisfaction could be realized in a job well done."
Read that back. "No sense of satisfaction could be realized in a job well done." That's not a complaint from a worker. That's the company's own document conceding that the job cannot produce satisfaction.
And the official remedy is the funniest and saddest part of the whole story. They built an enormous intramural sports program. Ten baseball teams. Twenty-six touch-football teams. Ten softball leagues, eighty-one teams total.
Morale management as a substitute for meaning. That's what a compartmentalized company's HR department would actually spend its budget on. Not engagement surveys. Softball.
And it worked, in the sense that it gave people something to belong to. But notice what it is. It's a competing source of identity, because the job can't supply one.
The manager quote is the one that gets me. George Turner, who ran part of the operation: "no one knew what was being made in Oak Ridge, not even me, and a lot of the people thought they were wasting their time here... I almost went crazy myself trying to figure out what was going on."
The manager doesn't know either. He's in the same information vacuum as the laundry counter, just with a better chair.
Which is the honest version of Daniel's anonymous middle manager. The manager isn't withholding the mission because he's protecting it. He's withholding it because he doesn't have it.
Though in Daniel's version the manager's identity is also hidden, which is a step further than Oak Ridge went.
One worker quit over the smokestacks.
Right. Two smokestacks that never emitted smoke. He concluded the place wasn't actually doing anything, so he left. They were intake stacks. They were designed to pull air in, not push smoke out.
He quit a job that was helping build the atomic bomb because the ventilation system was working correctly and nobody could tell him that.
And then the rumors. This is important, because it's the first hint of the leak dynamic that comes back later. The workers can't be told the truth, so they generate a version. The most colorful Oak Ridge rumor was that it was a model socialist community, built by Eleanor Roosevelt, as a prototype for Communist domination of the United States.
Inside the most classified weapons project in American history, the rumor was that it was a Soviet front.
The information vacuum doesn't stay empty. It fills with whatever is most narratively satisfying. And the wilder the truth you're hiding, the wilder the replacement gets, because people calibrate their guesses to the secrecy level.
Now hiring and onboarding, because Daniel asked specifically and Oak Ridge actually answers it. The company couldn't avoid telling people it existed. But it could withhold what it did.
The interview itself was the first compartment. You were hired into a role without a mission. Bill Wilcox didn't get told to keep quiet about the work. He got told there was no work description to give him.
Which is the mechanism by which the entire system sustains itself. Nobody is ever told enough to object. You can't quit over a mission you can't describe. You can't whistleblow on a purpose you were never given. You can't even resent it properly, because you don't know what you'd be resenting.
The onboarding doesn't induct you into the company. It inducts you into the absence of the company.
Herman.
I know. But it's true. The first thing you learn is that there is nothing to learn.
So that's what it felt like from the inside. Now let's look at what it did to the organization, because the CIA wrote the definitive insider account of that in 1977.
A document called "Critique of the Codeword Compartment in the CIA." And it's remarkable, because it's not an outside critic. This is the agency auditing itself, and concluding the system was eating the mission.
What did it find?
Start with scale. The codeword compartment may have been involved in up to half of total Agency man-hours.
Half the working hours of the CIA, spent on the compartment structure rather than on the intelligence.
And the report volume shows it. In 1975, the Office of Central Reference disseminated more than four times as many compartmented reports as non-compartmented ones. Four hundred forty-four thousand, eight hundred seventy versus ninety-eight thousand, five hundred fifty-one.
So the secret reports vastly outnumbered the ordinary ones. The default had flipped. Hiding became the normal state of the product, and sharing became the exception.
The access numbers tell the same story. Eighty-six percent of employees had COMINT access approvals. Sixty percent for TALENT-KEYHOLE. Forty percent for a third compartment.
If eighty-six percent of your staff has access to a compartment, the compartment isn't compartmentalizing anything. It's just an extra badge.
That's the finding that matters. The wall gets built, and then so many people are let through the door that the wall is decorative. But it still costs the same to maintain.
What did it do to how people actually worked?
The study says compartmentation "tends to subvert the formal channels of communication." That's the key phrase. The official org chart, the meetings, the memos, the chain of command, all of it gets bypassed. Because the real information is moving on a separate track that most people aren't cleared for.
And it created a specific social type. The report calls them "collectors of clearances." People who, in its words, "equating knowledge with power... have lost sight of need-to-know."
The badges became status symbols, fused with careerism. Your clearance wasn't a tool for doing your job. It was a rank.
That's a power technology, not a security measure. Need-to-know can be misused by anyone who wants to refuse others access, to increase personal power, to prevent review of their work, or to prevent embarrassment. The anonymous middle manager with sole feedback authority is a perfect vehicle for exactly that.
Daniel may not have intended it, but the structure he describes is a machine for converting secrecy into unaccountable power. The manager doesn't have to justify the grade, because you can't see what he's grading against, and you don't know who he is.
Did the CIA study connect it to actual failures?
It goes straight to the top. Its line is that it's arguable all intelligence failures, starting with Pearl Harbor, are attributable in some degree to abuses of compartmentation, to a failure to integrate information.
Pearl Harbor is the example, and it's almost too clean.
At Pearl Harbor itself, the decrypted Japanese communications were so restricted that the Hawaii theater commanders did not regularly receive them. The intercepts existed. The warning was in the building. It just wasn't in the room where the decision got made, because the compartment said it didn't need to be.
So the system designed to protect the mission actively degraded the mission. That's Daniel's "unexpected consequences" question, answered by the people who lived it.
And the recommendation is telling. The study proposed abolishing all existing compartments in favor of one uniform Sources-and-Methods Compartment. Which is, functionally, "we have too many walls, so let's have one wall."
They weren't ready to have no walls. Even the critique can't imagine openness. It can only imagine fewer, bigger boxes.
Which is a fair point about institutional inertia. The doctrine outlives its justification.
Now the upside, because Daniel asked for unexpected benefits, and there's a great one.
Richard Feynman at Los Alamos. The IBM mechanical-calculator operators were doing the computation for the project, punching numbers they didn't understand. And the work went slowly. Not because they were bad at it. Because they had no idea what the numbers were for.
So Feynman went to Oppenheimer and got special permission to give a lecture explaining what the numbers meant.
And here's his account. "They knew what they were doing. Complete transformation! They began to invent ways of doing it better. They improved the scheme. They worked at night. They didn't need supervising in the night... They understood everything; they invented several of the programs that we used."
Wait. Say the last part again.
They invented several of the programs that we used. The human calculators, once they understood the purpose, wrote the software.
So the upside isn't morale. It's a step change in productivity, self-direction, and invention. That's a hard operational gain, not a nicety.
Which is where the thought experiment starts to fold in on itself. Because that upside is self-defeating. The moment you let people understand their work, you get the productivity and the invention. Which is the exact opposite of the compartmentalization goal.
The premise contains its own refutation. You can have the walls, or you can have the Feynman effect. You can't have both, because the Feynman effect is caused by removing the walls.
And Oak Ridge is the proof from the other direction. They kept the walls, and they got baseball leagues and a rumor about Eleanor Roosevelt.
Which is a worse return on the secrecy investment than just telling Bill Ragan what the dial was for.
Now the leak question, because this is where the modern cases are useful. Daniel asks how fast the internal culture leaks onto recruiting forums even with robust NDAs.
And the answer is: fast, and through the channels the NDAs don't cover.
Palantir, February of this year. After weeks of employee pressure in internal Slack, following the killing of a Minneapolis nurse named Alex Pretti, CEO Alex Karp recorded a nearly hour-long internal video about the company's ICE work.
A nearly hour-long video, which presumably answered the questions.
It did not explain how ICE uses Palantir's products. And employees were told they could sign NDAs to get one-on-one briefings.
Sign a nondisclosure agreement to be told, in private, something the CEO just declined to say to the whole company on camera.
Karp's own line was, "There is no history of Palantir where we're 100 percent popular... And yeah, we're behind the curve internally."
"Behind the curve internally" is a remarkable thing for a CEO to say on a recording. It's an admission that the internal conversation had already outrun the official one.
And the internal Slack messages were reviewed and reported by WIRED within weeks.
So the sequence is: employees ask, leadership answers without answering, offers NDAs, and the whole thing lands in the press anyway. The NDA didn't cover the Slack thread, because the Slack thread was the pressure valve.
Which is exactly what happened at Oak Ridge. The laundry operation leaked to Business Week in 1943.
The laundry. Of all the things to leak, it was the uniform-counting.
Because it was the thing a person could describe without technically describing the project. "I count uniforms and listen for clicks." That's not a security breach. That's someone telling their family what they did at work. And it's enough.
Secrecy regimes generate exactly the informal channels they're designed to prevent. The rumor, the forum, the press. The harder you press the lid down, the more the steam finds a seam.
There's even a name for it in the modern context. The Streisand effect, as an organizational law. The act of suppressing the information is what makes it travel.
Talk about the other partial versions, because Daniel's company isn't the only one running a piece of this.
Apple reportedly runs a zero-trust internal architecture with black-box silos, designed so even high-level engineers can't see the full scope of a project. And interviewers are instructed not to disclose product roadmaps, team organization, or the tech stack until after an offer.
You can't even interview for the job without hitting the wall.
Tesla's Autopilot team compartmentalization was described in a sworn declaration unsealed in a Florida wrongful-death suit. SpaceX employees are often discouraged from discussing projects publicly, access is tightly controlled, and teams can spend months working without knowing the broader picture.
Months. Working on something, with a team, for months, without knowing how it fits.
And the most interesting one is Conjecture, the AI safety startup, because they published their policy.
They wrote it down.
Their Information Hazard Policy says, "The default mantra is need to know." And then: "Ideally, no one that does not need to know should know how many secret projects exist, which projects people work on, and what any of those projects are about."
So they're hiding the count. Not just the contents. The number of secrets is itself a secret.
Three disclosure levels: Secret, Private, Public. An appointed infohazard coordinator with access to all secrets. Written access documents. NDAs. It's a full regime.
And that's the one that's closest to Daniel's extreme. But Conjecture adds something the others don't.
Meta-honesty. When asked directly, employees must be transparent that a hiding policy exists, and why.
So you can hide what, but you must be honest that you hide. That's the escape hatch.
It might be the only version that survives contact with employees. Because it doesn't insult anyone's intelligence. It says: yes, there are things you're not being told, here's the reason, and here's the person who knows, and here's how access gets granted.
Which is the opposite of the anonymous manager. The manager can stay anonymous, but the policy can't. The hiding has to be disclosed even if the hidden thing isn't.
There's supporting evidence for the predicted harms, too. A study of two hundred eighty factory workers found psychological distress was about twice as high among workers with low individual workplace social capital. And low aggregated social capital was associated with roughly two and a half times higher odds of distress.
So isolation from the workplace social network is a measurable mental health risk. A risk ratio.
And there's a paper out this year on leader work-related secrecy, linking it to psychological contract violation and changes in employee discretionary behavior.
The contract violation is the interesting part. The employee didn't sign up to be kept in the dark. They signed up to do a job. And the secrecy reads as a broken promise, even when no promise was technically made.
The culture that develops in a company of workflow islands is one of measurable isolation, rumor, and quiet disengagement. It's the Oak Ridge baseball leagues, updated for the modern office.
Ping-pong tables instead of softball diamonds. Same function. Giving people something to belong to, because the job can't.
Daniel's company already exists. It's just not called a company. It's called a program, or a project, or a division.
It was a badge.
I worked somewhere that ran on need-to-know. Years ago, different building. And people always want to talk about the secrecy, like the secrecy was the hard part. It wasn't. The hard part was a laminated badge, and a form I had to sign to learn the name of a room I was already standing in.
You had to sign a form to be told where you were.
Two copies. One for me, one for the file. And the name of the room turned out to be the same name that was on the door. I just wasn't allowed to read the door.
The procedure for finding out what you were allowed to know was more bureaucratic than the work itself.
The work was four hours a day. The paperwork was six. I didn't mind not knowing what the company did. That part's fine. You get used to it. What bothered me was that the person who evaluated my work every quarter had a name I was not permitted to learn.
You never found out who was grading you.
For two years I thought it was a man in another building. Then I found out it was someone I'd been eating lunch across from. Same table. Two years. He knew. I didn't.
Did he ever say anything?
He asked me once how I thought I was doing. I said fine. He said, alright. That was the whole performance review.
You still have the badge.
I still have the badge. Blue with a white stripe. I always assumed the blue meant a clearance level, mid-tier, above the green ones. Kept it in a drawer for years, thinking it meant something.
Hilbert, I have to ask. What did the blue with the white stripe actually mean?
Parking. West lot. The green ones were east. There was no clearance hierarchy. There was a parking hierarchy.
Two years of thinking you'd been trusted with something, and it was a parking space.
They also flew me out once for a mandatory training session on information security. It was classified. I wasn't allowed to know what I'd been trained on.
The training itself was classified.
I passed. I have the certificate. The certificate is blank.
A blank certificate for a training you're not allowed to know the subject of.
I've been trying to find out what that training covered for years. I got a letter last month. The records were destroyed in a fire.
At the facility.
At a facility I'm not permitted to know the location of.
The answer to what you were trained on burned down somewhere you can't know about, and your certificate of completion has nothing on it.
That's all of it. That's what I wanted to say.
There's a question underneath all of this that we haven't quite answered.
Whether it's even stable.
Right. The Feynman story says the moment you let people understand their work, you get the gains. Self-direction, invention, they write the software. And the moment you don't, you get the baseball leagues and the rumor about Eleanor Roosevelt.
Which means the extreme version might not be a stable equilibrium. It might always collapse, in one of two directions. Toward transparency, or toward dysfunction.
The Conjecture model is the live question. Can you hide what you do while being transparent that you hide, and why? Is -honesty the only version that survives contact with employees?
That's the one I'd bet on. The hiding can survive. The pretending there's nothing hidden can't.
We're left with the image of the Oak Ridge worker holding a uniform up to an instrument, listening for a click.
For years. Not knowing what the click meant. Holding it up, listening, putting it back on the pile.
Only finding out after the bomb was used.
If you take one thing from this, take that. The secrecy didn't protect her. It just kept her from understanding her own hands.
It cost the project exactly what Feynman said it cost. Years of people who could have improved the scheme, instead doing it in their sleep.
That's the show for today. If you're enjoying it, a review helps more than you'd think, and it's the easiest way to get us in front of other listeners.
Thanks as always to our producer, Hilbert Flumingtop, for keeping this thing running.
For more along these lines, there's episode thirty-five, The Privacy Gap; episode twenty-one, Is Your AI Secretly American; and episode sixteen, On Deepfakes, SynthID, And AI Watermarking. This has been My Weird Prompts.
Send us your own prompt on Telegram at t dot me slash MWP listener bot.
We'll be back soon.
