Bounded permissions
Define the data and actions available to each worker and workflow.
Home / Security and Governance
Governed autonomy
Control what Claire can do—and where people must decide.
Governance is part of the workflow: permissions, system boundaries, human approval, exception routing, recordings, runtime visibility and quality review.
RequestUnderstand the person, context and desired outcome
CoordinateApply rules, maintain state and involve the right systems
ActExecute only permitted actions and communications
GovernEscalate exceptions and preserve human control
Governed autonomy
Built for operational depth.
Claire uses explicit permissions, human checkpoints, traceability and operational controls to govern automated workflows.
Human checkpoints
Require approval or takeover for consequential steps and exceptions.
Traceability
Preserve the conversation, workflow context, actions and handoffs available to the deployment.
Credential management
Keep integration credentials out of content and tenant-visible configuration.
Operational review
Use runtime, operations and quality surfaces to inspect behavior.
No invented certification
Security and compliance claims are published only when verified and scoped.
Human control
Automation with explicit boundaries.
Decide where Claire executes, where a person approves, and which exceptions require takeover.
Claire coordinates
Configured retrieval, preparation, communication and actions.
People remain accountable
Judgment, approval, relationships and consequential decisions.
Security questions belong in the workflow
Review the data, action and human boundary together.
Security is not established by a slogan. A deployment review should identify the data Claire receives, where credentials are managed, which actions are permitted, how tenant configuration is separated, what operational records are retained and how exceptions are reviewed.
Data scope
Collect only the information required for the workflow. Identify sensitive fields, retention needs and who can review conversation or workflow records.
Credential scope
Use controlled credential management and least-necessary permissions. Credentials should not be placed in public content, prompts or tenant-visible copy.
Action scope
Separate read, create, update and high-consequence actions. A workflow can prepare context or route approval rather than receiving unrestricted access.
Tenant boundaries
Administration and configuration are organized by customer environment. Deployment review should confirm which people can configure, operate and inspect each tenant.
Operational evidence
Recordings, runtime, operations and quality tools support investigation and review according to the configured deployment and access model.
Verified claims only
Contractual controls, regulatory obligations and certifications must be confirmed for the specific deployment. This page does not substitute for a security review.
Show us the workflow.
Bring the request, systems, policies and handoff points.
Security is expressed in the workflow
Reduce authority, isolate credentials, and make failure visible.
A production workflow needs more than a security label. Teams must define who can start the work, which identity is used, what systems and records are reachable, which fields are necessary, what Claire may read or write, where approval is required, and how access is revoked.
Customer-specific security, privacy, regulatory, data-residency, retention, and contractual requirements are validated during deployment. Claire should not publish a certification, integration, encryption claim, uptime claim, or compliance guarantee without verified evidence and an accurate scope.
Credentials
Store and manage integration credentials outside page content and workflow prompts. Assign an owner for provisioning, rotation, revocation, and incident response.
Tenant boundaries
Separate customer configuration, credentials, data access, and operations. Test identity resolution and prevent records from one context appearing in another.
Minimum access
Request only the objects, fields, and actions required for a bounded workflow. Separate retrieval, preparation, approval, and execution.
Operational evidence
Preserve available request context, decisions, tool calls, state changes, communications, handoffs, failures, and final disposition for review.
Security review also covers the communication channel and failure response: consent, recording notice, message retention, redaction, recipient verification, incident ownership, and what the workflow tells a person when an authorized action cannot be completed.
Before enabling a new action, test both over-permission and under-permission. Confirm that Claire cannot reach unrelated records or actions, and confirm that a denied or expired credential produces a visible exception instead of a false success message. Assign owners for access review, workflow changes, incidents, and evidence requests.
Review these controls again whenever a workflow gains a new data source, action, channel, geography, tenant, or human role.