How it works
The path one question takes.
Somebody types a question into the assistant they already use. About a second later they have an answer drawn from your live systems. In between are six steps, each of which was a decision somebody at your company made rather than a default we chose for you.
| 1 | Your identity provider verifies the person | theirs |
| 2 | One grant says which project and which tools | yours |
| 3 | Four checks narrow that, and can only remove | yours |
| 4 | The read runs against your system, live | yours |
| 5 | Your written rules shape how it is explained | yours |
| 6 | A row is written, allowed or refused | always |
Step one
The person is verified by you, not by us.
Sign-in goes through your own Microsoft work account. We never see a password, never hold a directory, and never run a second list of who works at your company.
What reaches us
A verified email address, and nothing else. No group memberships, no roles, no permissions. Whatever your directory knows about seniority or department stops at our door, because we have no way to interpret it that would still be correct next quarter.
Why that matters on the day somebody leaves
A colleague who left on Friday gets nothing on Monday, and not because we were told. There is no session to expire and no token to wait out. Their sign-in simply stops working, in the same system that already stops their email working.
Step two
Permission is one row, and it is the only way in.
A grant is a person, a project, and a list of skills. It is the sole path to any system. There is no second route, no admin override that widens it at runtime, and no way for a tool to open a connection without one.
| The unit | What it is | Why it is separate |
|---|---|---|
| Organization | Your company, as an isolation class rather than a label. | A customer organization can only ever reach its own projects. That is enforced where grants are created and again where they are used, so a provisioning mistake cannot become a leak. |
| Project | Exactly one database or environment, with its own connection secret. | Development, test and production are different projects. One company, one system was never true, so the environment is part of the address rather than a setting. |
| Person | One row per human, keyed by verified email. | Somebody who works across two of your environments is normal and governed, not an error to be worked around with a shared login. |
| Grant | Person x project x skills. | Revoking one is a database edit that takes effect on the very next call. There is no cache to wait for and no session still holding the old answer. |
An empty skill list grants nothing. That is the deliberate default. A person with a grant and no skills can reach no tool at all, rather than inheriting some sensible starting set that somebody would have had to remember to take away.
Step three
Four checks, and every one of them can only take away.
What the grant offers is then narrowed four times. Each check is a separate decision that can remove a tool and can never add one, so their order cannot change the outcome and no layer hands back what another refused.
-
01
The grant
Does this person hold this tool on this project at all? If not, it is not offered.
-
02
Ownership
A tool written for one client runs only on that client's project. Checked when a grant is created and again when the tool is dispatched, so the two cannot drift apart.
-
03
Availability
Whether the capability is switched on for your organization at all. This is the ceiling your administrators control, and it sits above any individual's grant.
-
04
A system on the other end
Whether the project actually has a readable connection of the kind that tool needs. A tool that cannot answer is never offered, so nobody is handed a capability that dead-ends at the first read.
The order is deliberate where it shows. The outcome does not depend on it, but the reason does, and check three runs before check four so that "your administrator has not switched this on" wins over "nothing is connected" – the answer somebody at your company can act on, first.
Step four
The read happens against your system, at the moment of asking.
Nothing was copied here in advance and nothing is kept afterwards. The query runs against your database with your credential, and the figures travel back through the answer without ever being stored.
No index, no copy
There is no store of your content to fall out of step with your permissions, because there is no store of your content.
The answer names its environment
Every result says which system it came from. An unlabelled number from the wrong environment is worse than no answer at all, so we refuse to produce one.
Ambiguity is refused, never guessed
Two possible targets and no default is a refusal with the list, not a pick. Silently choosing is how a number gets attributed to the wrong system.
Step five
Your written rules ride along, and cannot widen anything.
Your vocabulary, your conventions and your guidance on how a tool should be used reach the assistant after every access decision has already been made and after the read has already happened.
What that text can do
- Shape the explanation. Your names for things, your conventions, your caveats.
- Add context a schema cannot carry, approved by a named person before use.
What it structurally cannot do
- Widen access. It arrives after the decision, so there is no decision left to change.
- Reach another project's session. Four independent checks hold that line.
- Be treated as an instruction. It is carried as data and labelled untrusted wherever it travels.
It is deliberately not filtered for "injection phrasing". That is an unwinnable game, and a filter that appears to work is worse than none, because everything downstream then assumes the text is safe.
Step six
A row is written either way.
Allowed or refused, the call is recorded with the reason as a name rather than as a log line written for a developer. Refusals are recorded as carefully as successes, because a pattern of refusals is the more interesting signal.
The reviewer's version of this page.
Same mechanism, written for somebody whose job is to find the hole in it, including the parts where our own enforcement is the only one standing.