Ethical rules provide for the confidentiality of one-on-one conversations between a lawyer and their client. But what happens when the client is an organization that employs multiple people? To whom is the duty of confidentiality owed?