AI and PHI
How AI features handle protected data: minimum-necessary and query-scoped, grounded in the operator's own authorized view, and run inside the same compliant cloud.
The platform puts AI features over operational and protected data. Because protected data is present, those features carry explicit access controls. This page describes them as design intent.
Posture document. The guardrails below describe the intended design, not a representation that any guardrail is currently audited or in production. Coverage is not compliance.
Minimum-necessary, query-scoped access
AI features fetch only what a task needs.
- An assistant reads the specific data its task requires, not the whole store. There is no "read everything" grant for any AI feature.
- Access is scoped to the request and recorded, the same way any other access is.
- No AI feature does a speculative broad pull of protected data "just in case."
Grounded in the operator's own view
An assistant is grounded only in the data the person using it is already authorized to see. It does not get a wider view than the operator behind it, and it does not hold a standing grant to protected data independent of that operator's scope. When the assistant uses a tool, the call runs under the operator's role and scope, so the same access and audit rules apply.
This is why Agentic Studio never reaches beyond your authorized data and never crosses into another organization's records.
Inference inside the compliant cloud
Model calls that involve protected context are designed to run inside the same compliant cloud as the data, under the same agreement, rather than being sent to a separate vendor surface. Features that are not covered for protected data are kept out of protected flows.
Prompt-injection posture
Assistants read text that may come from outside, so prompt injection is treated as a live risk rather than an edge case.
The defense is structural: an assistant cannot escalate beyond the operator's own scope no matter what instructions appear in the text it reads. Access decisions live in role and organization scoping, not in the assistant's instructions, so injected text cannot grant access the operator does not already have.
- Scope is enforced outside the prompt. Text the assistant reads cannot rewrite access decisions.
- Untrusted content is data, not commands. Material pulled in for grounding is reasoned over, not obeyed.
- Tool calls are audited. Any tool call an assistant makes is recorded the same way an operator's own action is, so an injection attempt that triggers a tool call is visible in the trail.
See also
- Access and audit for the access and audit controls AI features inherit.
- Agentic Studio for the product these guardrails sit behind.