Limits
What it cannot do.
The fastest way to understand a governed layer is to know what it refuses. This page exists because the alternative is that you find these out during an evaluation, or worse, after one.
Three different kinds of "no" appear below and they are not interchangeable. Some are properties of the design and will never change. Some are deliberate refusals we would argue for keeping. And some are simply unfinished, with no date attached, because a roadmap promise is a claim too.
Structural
Impossible by design, not by policy.
These are not settings. Changing any of them would mean deleting code rather than editing configuration, which is the point.
It cannot reach a system you have not connected
There is no discovery step and no default connection. A tool with no bound project cannot open any connection at all, because the component that reads holds no address of its own and must ask for one on every single open.
It cannot widen its own access
Every narrowing check can only remove. There is no code path that adds a capability back after another layer refused it, so no ordering of checks and no combination of settings produces more access than the grant allowed.
It cannot carry permission between your environments
A credential issued for one environment cannot be replayed against another. Each has its own address, and the token is bound to the address it was issued for.
Your written rules cannot become instructions
Text your administrators author arrives after every access decision and after the read. It is capped, labelled untrusted wherever it travels, and cannot reach another project's session.
Deliberate
Refusals we would argue for keeping.
Each of these could be built. Each has been asked for at least once. They are not built because the version that works is worse than the version that refuses.
| It will not | Because |
|---|---|
| Guess which system you meant | Two candidate connections and no default is a refusal with the list attached, not a pick. Silently choosing is how a figure gets attributed to the wrong environment, and that error is invisible in the answer. |
| Infer your environment | Every answer names where it came from. A number without its environment is worse than no number, because it looks like an answer. |
| Filter your text for prompt injection | It is unwinnable, and a filter that appears to work is worse than none: everything downstream then assumes the text is safe. It is carried as untrusted data instead. |
| Tell a caller why they were refused, in detail | A refusal never teaches the caller about another client – not whether a project exists, not who owns a tool, not another organization's identifiers. Your own administrators see the full reason; the assistant does not. |
| Hold your figures to make answers faster | A cache of your data is a copy of your data, with all of a copy's problems and none of its excuses. |
Not finished
What is genuinely incomplete, with no date attached.
This section is the reason the page is credible, so it stays even when it is uncomfortable. A roadmap date is a claim, and we do not have evidence for those dates.
Writing back is off everywhere
The platform reads. A write path exists in the wider codebase and is not switched on here for anybody, because "the assistant changed a number in the plan" needs a gate, a ledger and an approval story that we would rather ship late than ship early.
Most connectors are modelled, not working
Twenty-six systems are described in the connection vocabulary; four have working adapters today. The console says plainly which is which rather than accepting a connection that would fail the first time somebody used it.
Certification is a status, not a badge
We publish where we actually are with dates rather than a logo wall. If a framework matters to your review, ask and you will get the honest position, including the parts that would not pass today.
Answer quality is not yet measured here
There is a difference between "the tool answered" and "the tool answered correctly", and the harness that measures the second has not been brought across yet. Until it is, treat accuracy as something to verify in your own evaluation rather than something we have proven.
The ledger
Held here, and never held here.
Held
- The decision. Who may reach what, with which tools, under whose rules.
- The record. Every call, allowed or refused, with a named reason.
- Your written rules, approved by a named person before anything uses them.
- Connection secrets, in a vault, one per environment.
Never held
- No model, and no inference bill. We run no AI of our own.
- No copy of your figures. Reads run against your system, per request.
- No copy of your documents. Read with your credential, not stored.
- No standing access. Revoking a grant takes effect on the next call.
- No directory of your people. Your identity provider stays the only one.
If this page changed your mind, it did its job.
The security summary carries this same list plus the control mapping behind it, and it is written for somebody whose job is to find what this page left out.