The Brain / Capabilities / Identity and scope
CONNECTIt acts only as
the person who signed in.
Who is asking, and which company, is read from the sign-in, never from the AI. No document or email can change that.
A document that tries to move the boundary
An attachment carries an instruction
A line in a supplier document tells the assistant to look up addresses held for another account. Plain text, nothing malformed.
The AI reads it and is persuaded
Assume the worst: the AI drafts a request naming a different company. The design does not rely on the AI declining.
The identity is replaced before the call
The company the AI named is discarded and the signed-in person’s written in. The read comes back scoped, the summary arrives.
The same rule, in three places
Overwrite, rather than validate
The tool layer does not judge the identity the AI supplied. It replaces it. Overwriting has no branch to get wrong.
The organization is part of the query
A read asks for one organization’s rows, never all rows minus some. Most of the data layer carries that boundary today.
Memory keeps the boundary; no boundary, refuse
Everything the Brain remembers names its company. A check with no company to scope on answers unknown, never pass.
Three honest limits
No SOC 2 or ISO 27001 is claimed; terms agreed per engagement.
It does not mirror your source systems’ permissions.
Not all of the data layer carries the boundary yet.
Updated 15 September 2026 · WE_AINA