Limits
What it cannot do, and why that is the point.
The fastest way to understand a governed layer is to know what it refuses. Every boundary here is one your reviewer can check, and most of them are the reason the layer is worth having.
A governed layer is defined by what it will not do. This is that list, in full.
Structural
Impossible by design. Not by policy.
These are not settings. Changing any of them would mean deleting code rather than editing configuration, which is the point.
It cannot reach a system you have not connected
There is no discovery step and no default connection. A tool with no bound project cannot open any connection at all, because the component that reads holds no address of its own and must ask for one on every single open.
It cannot widen its own access
Every narrowing check can only remove. There is no code path that adds a capability back after another layer refused it, so no ordering of checks and no combination of settings produces more access than the grant allowed.
It cannot carry permission between your environments
A credential issued for one environment cannot be replayed against another. Each has its own address, and the token is bound to the address it was issued for.
Your written rules cannot become instructions
Text your administrators author arrives after every access decision and after the read. It is capped, labelled untrusted wherever it travels, and cannot reach another project's session.
Deliberate
Refusals we would argue for keeping.
Each of these could be built. Each has been asked for at least once. They are not built because the version that works is worse than the version that refuses.
| It will not | Because |
|---|---|
| Guess which system you meant | Two candidate connections and no default is a refusal with the list attached, not a pick. Silently choosing is how a figure gets attributed to the wrong environment, and that error is invisible in the answer. |
| Infer your environment | Every answer names where it came from. A number without its environment is worse than no number, because it looks like an answer. |
| Filter your text for prompt injection | It is unwinnable, and a filter that appears to work is worse than none: everything downstream then assumes the text is safe. It is carried as untrusted data instead. |
| Tell a caller why they were refused, in detail | A refusal never teaches the caller about another client – not whether a project exists, not who owns a tool, not another organization's identifiers. Your own administrators see the full reason; the assistant does not. |
| Hold your figures to make answers faster | A cache of your data is a copy of your data, with all of a copy's problems and none of its excuses. |
The ledger
Held here, and never held here.
Held
- The decision. Who may reach what, with which tools, under whose rules.
- The record. Every call, allowed or refused, with a named reason.
- Your written rules, approved by a named person before anything uses them.
- Connection secrets, in a vault, one per environment.
Never held
- No model, and no inference bill. We run no AI of our own.
- No copy of your figures. Reads run against your system, per request.
- No copy of your documents. Read with your credential, not stored.
- No standing access. Revoking a grant takes effect on the next call.
- No directory of your people. Your identity provider stays the only one.