Security: an assistant that reads no more than its reader
The worry is legitimate and it is always the same one: by handing your documents to an AI, are you opening up to everyone what only a few were allowed to read?
In short
Access filtering happens during the search, not after it. A document or a graph object a reader is not allowed to see never enters the perimeter being searched, so no answer can rest on it, or even hint that it exists. Rights are set by role and per object, each organisation is partitioned from the others, secrets are encrypted, and every access leaves an exportable trace.
Why does the timing of filtering change everything?
There are two ways to make an assistant respect access rights, and from the outside they look alike.
The first searches everywhere, then strips from the answer what the reader was not allowed to see. It seems sufficient and it is not: the model doing the writing has already read the forbidden documents, and what is missing gets noticed. An answer that stops halfway through a list teaches something about what it is withholding.
The second narrows the perimeter before running the search. What is out of bounds is never retrieved, never passed to the model, and nothing in the shape of the answer betrays its existence. That is the one implemented here, in the graph as well as in the search index.
The difference does not show in a demo. It shows the day someone asks the right question.
How are rights set?
Five roles ship with the platform, and they cover the usual split of responsibilities.
| Role | What it can do |
|---|---|
| Super administrator | Everything, across the whole installation |
| Administrator | Accounts, roles, supervision, audit log |
| Data engineer | Connections, pipelines, graph, documents |
| Analyst | Querying, dashboards, reading the graph |
| Viewer | Read-only |
These roles are a starting point, not a constraint: rights are also set object by object, on entities, relations and documents.
One design detail deserves a mention, because it shows the intent. The right to administer automations and connections is not granted to the data engineer, even though they are precisely the person who creates them. The reason is that administering here means seeing and managing every object in the organisation, including those their authors kept private. Handing that right to the population that creates those objects would make the notion of private meaningless. So it stays with the administrator.
What is encrypted, and what never comes back out?
Account passwords are not stored: only their fingerprint is, computed by a function designed to be slow to attack.
Connection secrets follow another rule, stricter still. They are encrypted at rest, and above all no read returns them, not even to the person who entered them. A read returns a mask and the list of filled fields, never the value. That is what makes it possible to share a connection with a team without handing over the password it carries.
Exchanges with the platform go over an encrypted link, and session tokens have a short lifetime, renewed through a separate token.
What is left on record?
Three logs answer three different questions.
The audit log records accesses and actions, and exports to CSV or JSON over the requested period. That is the one you produce for an auditor.
The exchange log keeps, for each question put to the assistant, the sources consulted, the response time and the cost. That is the one that lets a drop in quality be observed in figures rather than impressions, and traced back to a source or a type of question.
The pipeline log records what was read, what failed and why. That is the one you consult when a source stops responding.
What the platform does not do for you
A tool makes nobody compliant, and pretending otherwise would be dishonest.
The obligations borne by a company using AI concern human oversight, informing the people involved, user competence and keeping records. None of them is satisfied by a setting. What a tool can do is make them documentable: an approval step that embodies oversight, a log that embodies record-keeping. The rest is down to your organisation. That is the subject of the page on the AI Act.
In the same way, where data sits is not settled by an option but by a mode of installation, described on the sovereign AI page.