The AI layer
Two surfaces, one governance model.
| Surface | For | Reaches the platform as |
|---|---|---|
| Governed MCP endpoint | External AI agents and assistants | The signed-in user |
| In-app assistant | People using the console | The signed-in user |
Neither holds business logic. Both are presentation over the same API that serves every other consumer, which is what makes their governance identical rather than merely similar.
The governed endpoint
An endpoint speaking the Model Context Protocol, exposing the platform's operations as tools an agent can call.
Each request carries the user's own credentials, so every one of the four enforcement layers re-evaluates. There is no service account: the endpoint has no privileged identity of its own to fall back on.
Read operations and mutating operations are both exposed, with mutations gated behind an explicit two-call confirmation — a preview, then a commit. An agent cannot mutate in a single unconsidered step.
The in-app assistant
Asked why two records matched, the assistant reads the scoring breakdown rather than guessing: last name exact +5.28, email exact +5.20, first name mismatch −4.54, netting 5.94 — the same composite weight the screen beside it shows, in the clerical-review band because it sits between the two thresholds.
A chat surface inside the console. It answers questions about what is on screen, explains why a match scored as it did, and can carry out actions with approval.
It renders values exactly as the API returned them, including masked ones. It does not recompute scores or infer values — it shows what the platform said.
Autonomy modes
The assistant runs in one of three modes, per conversation:
| Mode | Behaviour |
|---|---|
| Manual | Every action is approved individually |
| Accept edits | Reversible actions proceed; destructive ones ask |
| Auto | Actions proceed without asking |
The mode governs whether a person is consulted. It never governs what the request is permitted to do. An agent in auto mode operating for a read-only user still cannot write — the request is refused exactly where any other unauthorized request is refused.
Every exposed mutation is reversible, which is what makes the more permissive modes defensible.
What agents cannot do
- See anything the operating user cannot see.
- Reconstruct a masked value. They receive the mask.
- Escalate their own permissions.
- Act untraceably. Everything lands in the audit log, attributed to the user.
Next
Last verified against commit 952ed91b (2026-08-03)