Security & governance
Permissions are resolved in code you can audit, never delegated to the model.
This page describes the exact security model running in production, in plain language. It is the same story we walk your security team through, with the verification evidence behind each claim.
The design principle
Generative models are probabilistic. Access control must not be. So the decisive control in XNOR Agents is a deterministic filter that decides which documents enter the model context, per person, per request. Prompt rules and AI reviewers exist as additional layers, but they are explicitly secondary. The same doctrine runs through everything we ship: least privilege, evidence before answer, fail closed, and human accountability for every high-impact decision.
What the model is never shown, it cannot reveal. Not to a clever prompt, not to a persistent attacker, not by accident.
Four independent layers, every one fail-closed
Least privilege at the source
The agent’s credentials are scoped at the platform layer to exactly the libraries it serves. Out-of-scope access is denied by your platform itself, not by our code, and this is proven with negative tests that expect access-denied. In the Knowledge Agent verification, 12 of 12 bypass attempts were denied, including direct addressing of confidential storage.
Documents filtered in code, before the model
A deterministic allowlist maps each access tier to permitted folders. Every retrieved candidate is checked against its live location, pinned to the configured document library, and dropped on any mismatch. Hard denylists for the most sensitive folders are compiled into the code, deliberately out of reach of configuration.
Prompt policy that resists manipulation
Retrieved documents are wrapped as untrusted data. Structural markers are neutralized so a document author cannot forge system instructions, and the draft handed to the reviewer is fenced so a planted document cannot impersonate the compliance reviewer.
Every answer post-checked before it is sent
A deterministic screen catches credentials, account numbers and personal pay amounts. An independent model then reviews the draft against your data policies and returns a strict verdict: only an explicit pass ships. Style issues get one corrective retry; data violations never do.
Fail-closed, everywhere
Permissions cannot be resolved? The person is treated as unprovisioned. The reviewer verdict is unreadable? The answer is blocked. The chat type is unknown? It is treated as the most public audience. A retrieved file reports no location? It is dropped. Every default protects your data, and every one of these defaults is pinned by tests.
Two controls most AI assistants do not have
The group-chat audience rule
In a group chat the answer follows the least-privileged member present, even when the CEO is asking. The agent invites the asker into a private chat for the full answer, and never reveals which member caused the restriction. Leak prevention, automatic.
Deterministic citation integrity
A fabricated source is worse than a refusal, because it makes a wrong answer look verifiable. A code-level check verifies that every file the answer names was actually retrieved this turn. It is model-independent, so it survives every provider swap.
Governance, audit and operations
Immutable audit trail
One permanent row per question: who asked, at which tier, the keywords extracted from the question, what was retrieved, what the reviewer decided and the status of the answer. The wording of a question and the text of an answer are never stored. Kept without expiry, aligned to ISO 27001 practice, with review queries prepared for your compliance team.
Identity is your identity
Access tiers bind to your corporate directory groups. Removing a person from a group ends their access within 15 minutes. There is no separate user database to drift out of sync.
One isolated stack per agent
Each agent has its own credentials, its own storage and its own secrets. A compromise of one agent does not touch its siblings, and the blast radius of any secret is one function.
Evaluation gates before every release
Adversarial security evaluations run against the live models and must fully pass before any prompt or policy change ships. Model swaps go through the same gate.
Privacy-preserving analytics
The usage dashboard stores topics and retrieved document paths, never the wording of questions. Cost, quotas and quality are visible without building a surveillance tool.
Secrets never touch a human clipboard
Credentials live in a secured parameter vault, fetched once at start, never logged. Rotation is piped directly between systems, so a secret value never passes through chat, email or a file.
Quality measured, not assumed
Every answer carries a thumbs up or down, and the vote is written onto the same audit row as the guard verdict. That pairing yields the one number security testing cannot produce: how often the guard blocked an answer its reader actually needed. A thumbs down opens an optional note of up to 300 characters, which stays in the agent’s own table; only counts ever reach a dashboard.
Compliance posture
The architecture is designed for review: audit trails aligned to ISO 27001 practice, personal-data protection shaped by Vietnam’s Personal Data Protection Law (Law 91/2025/QH15, in force since 1 January 2026) for our own deployment, and a formal risk register in which every accepted risk is named, dated and signed by its decision maker. In your engagement, the same artifacts are produced for your regulatory context, including the heavier evidence pack regulated sectors expect (see our work in financial services).
Talk to engineering
Bring your security team.
The demo is more interesting with your hardest questions. We will show the controls, the tests behind them, and the audit trail they write.
We are happy to walk through the threat model in the same call.