The governance model
Every request — from an application, an AI agent, or a person — passes through the same four layers.
| Layer | Decides | Enforced |
|---|---|---|
| Tenant isolation | Which rows exist for this caller | In the database |
| Permissions | Whether this action is allowed | At the request boundary |
| ABAC policies | Whether this record is visible | On each record, when loaded |
| Field masking | Whether this value is visible | When the response is generated |
Why four, and why independent
Each layer answers a different question, and none assumes another did its job. A defect in one does not open the rest, and the innermost is enforced by the database rather than by application code.
The layering also lets a rule be expressed where it belongs: "stewards may read entities" is a permission; "but not records flagged restricted" is a policy rule; "and never the identifier field" is masking. Collapsing those into one mechanism would make each of them harder to express and to audit.
The same rules for AI
This is the platform's central claim, and it is an architectural property rather than a policy.
An AI agent reaching the platform does so as the signed-in user, carrying that user's identity. Every one of the four layers re-evaluates. An agent therefore sees exactly what its operator sees — no more.
Two design choices make this hold:
- No service account. There is no privileged identity the AI layer uses on a user's behalf. If there were, the agent's reach would be that identity's reach, not the user's.
- Masking is applied on response generation, not per endpoint. There is no alternative surface that returns the value unmasked, so the AI layer receives the masked value and can only ever repeat it.
The practical consequence: granting someone access to an assistant grants no data access at all. Their permissions already decided that.
Autonomy is not authorization
An agent may be permitted to act without asking each time. That governs whether a person is consulted — never what the underlying request is allowed to do.
An agent in its most permissive mode, operating for a user with read-only permissions, still cannot write. The request is refused where every other request is refused.
Everything is recorded
Actions taken through the AI layer land in the same append-only audit log as any other action, attributed to the user whose identity was used. There is no separate, less-traceable path.
Next
Last verified against commit 952ed91b (2026-08-03)