Built, and running in production.

The tenant scope is applied by the data-access layer rather than by each call site, so an individual query cannot decline it. Enforcement is switched on in production infrastructure and asserted in continuous integration against a real database across read, count, update, delete, cross-tenant create, missing-context and concurrent-context cases.

A model added to the schema without a tenancy classification fails the build. The classification is a registry, so the decision is reviewable rather than implicit.

An incoming officer is added to a seat before their term begins with read-only access to the seat’s record, including the knowledge cards scoped to that seat. On the start date it becomes write access. An outgoing officer moves to alumni: the record stays, the access does not.

An outgoing administrator keeps authority until a named successor accepts. The grant and the step-down then happen together in one transaction, so there is no window where nobody can approve and no shared account in between.

Sixteen named capabilities across three strictly nested staff tiers. Navigation is derived from the capabilities the signed-in seat actually holds, so a reviewer is never shown a surface they cannot use.

A Director-tier capability, approval.override, can force-approve or force-reject any request in the institution, bypassing both gates. It is the highest-privilege action in the product.

Privileged actions append an audit row, and refusals are recorded as well as successes, which is what lets an office prove that something did not happen. Rows are only ever created: no update, delete or upsert against the audit table exists anywhere in the application.

Each approval step permanently records who decided, the seat they held at that moment, what the request moved from and to, and, where a backup approver acted, that it was done on another seat’s behalf.

The database and the document bucket are encrypted at rest, and the container registry uses managed keys.

No document is served from a raw object URL. Every download is a signed link that expires in ten minutes.

A seat carrying assignments, holdings or knowledge is refused deletion and must be retired instead. An active assignment is revoked to alumni rather than removed. This is deliberate: it is the property the whole product rests on.

All traffic is redirected to HTTPS at the edge, with a TLS 1.2 minimum.

The database takes automated daily backups in a fixed window, has deletion protection enabled, and takes a final snapshot on teardown. The document bucket has object versioning enabled, so an overwritten file can be recovered.

The corpus is assembled under the asking person’s own permissions before anything is ranked or sent, so the model is never given records that the person asking could not already open themselves.

Answer synthesis runs on a managed model service inside our own cloud account. It authenticates with the task role the application already runs under, so there is no long-lived model API key to rotate or leak. Three things are sent: the records retrieved for a question, the contents of a text document when a summary is requested, and the instruction typed into Draft Assist, so some of your record does leave our own infrastructure at those moments.

Retrieval is keyword matching over five record kinds, knowledge cards, document titles and descriptions, approvals, events and organization records. Answers link the records they came from.

If synthesis is unavailable, the ranked and permission-scoped sources are still returned. The assistant panel says which happened; the search page shows the sources without distinguishing an unavailable model from a query that matched nothing.

Accounts live in a managed identity service and each person signs in with their own email and password, a 12-character minimum requiring upper case, lower case, a number and a symbol. Credentials are verified server-side against the pool rather than through a hosted redirect, and account recovery runs to a verified email address and nothing else. Accounts are still created by us in advance against a named person: there is no public registration and no self-service signup. Authentication and membership are separate questions, holding a the identity service account is not access to an organization, which is decided from the roster.

Time-based one-time-password multi-factor is available on the user pool and a person can enrol an authenticator app.

A per-user signed feed that Outlook, Google Calendar and Apple Calendar can subscribe to with one link. No account connection and no password shared; the feed shows only what that person is already allowed to see.

Budget spreadsheets are imported with column matching, and PDF, Word, Excel and PowerPoint files open in the application. Text files and spreadsheets can be edited in place with a save-conflict check.