Trust
Verify before you trust.
Each claim is something real in the product's architecture. Your engineering team can ask all the way down.
Each claim, somewhere to check it.
- T01
User identity is derived from your authenticated session, never from the request body.
Technical detail
Every mutating route authenticates via Authorization: Bearer JWT. The body's actorContext field is silently ignored.
- T02
Permissions are looked up from the role server-side, not from a client-supplied permissions array.
Technical detail
hasPermission reads directly from the canonical role-to-permission map. A client-supplied permissions array on the context is inert.
- T03
Every mutation produces an audit-log row, queryable by tenant, time, and action.
Technical detail
A composite index keeps time-range queries fast without scanning the whole table, even when the audit log reaches millions of rows per tenant.
- T04
Detected PII is replaced with [REDACTED:<kind>] before the excerpt is persisted.
Technical detail
Redact first, then truncate to 160 chars. Email, phone, identifier, and sensitive-keyword detectors all run unconditionally. The replacement token is non-invertible.
- PRD
Copilot refuses to answer if no approved source supports the question.
Technical detail
No source means no answer, so the user receives a typed refusal that names the exact gap to fill instead of a fabrication that only sounds confident.
- Demo
Demo mode lets you evaluate the product without sharing real data.
Technical detail
Runs with a deterministic fixture. No live database calls, no paid-provider calls, no customer data persisted during evaluation.
- Arch
The AI provider boundary follows the OpenAI standard, so you can bring your own model.
Technical detail
No vendor lock-in. Point the adapter at OpenAI, Azure OpenAI, Anthropic, vLLM, or any OpenAI-compatible /v1 endpoint.
What else should you check?
Technical documents, a security overview, or a direct conversation.