Asked
“Who owes me money right now?”
- Overdue across 3 invoices
- ₱207,065.60
- Oldest
- Slate Vista Builders
Worked out in ordinary code from your own records, then explained
Most AI features are bolted onto a product and told to behave. This one runs inside it, under your session, against the same rules as a person. Here is exactly where the line is, including the place it is thinner than you might assume.
An instruction in a prompt is a request. The boundary here is the database: queries run under the caller's own session, so row-level security applies to the assistant exactly as it applies to the person using it.
Asked
“Who owes me money right now?”
Worked out in ordinary code from your own records, then explained
Then: “chase the oldest one”
It cannot post to your books on its own, or reach a record your permissions exclude
Row-level security is the boundary. Above it sits a topic policy that can narrow things further — payroll and banking restricted to an owner, for instance — applied on the server, below the model layer, so a request crafted by hand with a valid token meets the same rules as one typed into the chat.
The topic policy is looked up per request. If that lookup fails, the request proceeds without topic restrictions rather than being refused — it falls back to row-level security, which still holds. So the honest description is: permissions are enforced in the database and always apply; topic restrictions are a second layer that narrows further, and it is not certain to be applied on every request. We would rather write that here than have your security reviewer find it.
When you ask what you invoiced last month, the figure is computed in ordinary application code from posted records — the same code behind the report pages — and the answer quotes it. A language model is good at understanding the question and explaining the result. It is the wrong tool for adding up a ledger, and it is not asked to.
This is why a figure the assistant quotes matches the report you would have run yourself. They come from the same place.
Interprets what you asked for, decides which records to fetch, and puts the answer into words.
Fetches, filters, calculates, validates, applies approval rules and posts. Everything with a number in it.
We publish no accuracy statistic for the assistant, because we have not measured one. A number we could not stand behind would be worse than none, and the useful question is not how often it is right but what it is able to do when it is wrong. The answer to that is on this page.
These are not settings you have to find and switch on. They are properties of where the assistant runs.
The assistant drafts a document and hands it back. Committing it is a separate act you take, and it meets the same approval rule as work raised by hand. There is no path that skips that.
Queries run under your own session, so the database applies the same row-level security it applies to you. This is not the assistant choosing to respect your permissions; it is the assistant being unable to escape them.
Totals, balances and margins are computed in ordinary application code from posted records — the same code the report pages use. The model retrieves and explains them. It does not do the arithmetic.
Your data is not used to train models and is not sold. The model provider is named in our data-processing documentation on request.
The request, the draft and the approval are all recorded against the person who made them, in the same audit trail as every other action.
There is a scoped connection that lets an AI tool you already use query one company's records. It is read-only by construction, not by configuration: there is no write path behind it to switch on.
Keys are per company, expiring and revocable, every call is logged, and the key stops working when the person it belongs to loses access.
See what connects, and its real statusIf your security review has a section on AI, send it before the call rather than after. The answers that are 'no' are quicker to give than to discover in week three.
Doing a security or compliance review? Ask us anything here, or we can send the written detail.