Security approach
Control belongs
in the design.
Clear permission boundaries, exact approvals and inspectable outcomes guide the bounded core. This page describes implementation choices and limits, not a certification.
A deliberate boundary around each decision.
Authenticated operations
The core requires owner sign-in and applies workspace membership checks to its resources. The public synthetic workspace is a separate demonstration and does not grant access to core records.
Approval for the exact action
Task, actor, workspace, account, recipient, content, commitments, sources and expiry are part of the approval boundary. A changed or stale proposal must not reuse an earlier approval.
Evidence treated as data
Source text is untrusted context. It cannot grant an agent new permissions or authorize external actions. Structured model outputs are validated before business state changes.
Restricted specialist execution
The bounded integration uses a configured local model with agent tools disabled. The specialist roles have no supported path for sending email, browsing accounts or administering the host.
Know what happened. Know the remaining work.
Internal changes with a receipt
Approved drafts and commitments are recorded together with their internal receipt. The record describes that internal action; it is not a provider delivery confirmation.
Visible unsuccessful outcomes
Tasks can fail, block, cancel or require a new decision. The interface should show those outcomes without quietly relabeling them as completion.
Recovery is an evidence gate
An encrypted off-host production backup restored successfully into a fresh isolated database, with matching schema and business records. This is a logical database restore test; full host recovery, scheduled backups and recovery-time or recovery-point guarantees remain outside this release.
Where further assurance is required.
Independent customer isolation
Workspace authorization is part of the core. Admission of unrelated customers still needs further isolation, identity, credential and operating review.
External connector permissions
Mailbox, drive, messaging and third-party CRM access are not configured capabilities. Each future connector needs its own scope, authorization, failure handling and verification.
Formal assurance
No SOC 2, ISO certification, penetration-test attestation or regulatory-compliance claim is made here. The presence of technical controls is not a substitute for independent assurance.
Evaluate with care.
Use synthetic or non-sensitive material while evaluating the product. Read the exact proposal and its sources before making a decision. Do not assume a model’s answer is correct because it is detailed or confident.
Do not place passwords, access tokens or unrelated personal information into source text. Product browsing does not create a confidentiality, support or managed-service agreement. Review the privacy and terms notices for the current public experience.
Practical questions.
Does local inference mean no data is processed?
No. The authenticated core processes the request and selected evidence in its configured environment. Public hosting and edge services also handle web requests; the privacy notice explains the public experience.
Can I use this for regulated or critical decisions?
The preview is not offered as a validated regulated decision system. A deployment would need a specific risk assessment, operating controls and applicable professional or legal review.
How should I raise a concern?
The contact page describes the current communication route. Share a concise description without including passwords, private keys or other people’s sensitive information.
A considered next step
Understand the boundary before using the capability.
Read the product guide, distinguish the preview from operations and inspect the evidence behind every consequential decision.