For security, governance & engineering leaders
Approval and access enforced before retrieval
Do not ask a model prompt to remember which facts are approved or who may see them. Curated Data checks workspace, token scope, classification, and revision status before MCP or REST returns content.
- Drafts excluded from retrieval
- Workspace and classification boundaries
- Author, reviewer, and revision history
- Portable markdown and REST fallback
Enforce the boundary outside the prompt
The retrieval service authenticates the caller and filters by workspace, permission scope, allowed classifications, and approved status before returning a concept.
Keep unreviewed changes off the agent surface
Draft, rejected, and in-review revisions stay unavailable. The earlier approved revision remains current until a reviewer approves the replacement.
Make each approved fact inspectable
A stable path and numbered revision preserve who authored and approved the change, so a disputed source can be investigated without reconstructing a deployment.
Avoid a single-protocol exit
Agents can retrieve the same approved revisions over hosted MCP or REST, and the underlying concepts remain portable markdown and YAML.
Questions
- Does the model enforce access control?
- No. Access is enforced by the service before content is returned. The model only receives concepts that the authenticated workspace token and its allowed classifications can retrieve.
- Can one token read another company’s workspace?
- No. Tokens are scoped to one organization, and workspace context is applied at the same retrieval boundary that filters approval state and classification.
- Can access be rotated or revoked?
- Yes. API tokens can be rotated or revoked at any time, and the old secret stops working immediately. Rate limits and usage metering apply per organization.
- Does Curated Data claim a specific compliance certification?
- No blanket certification claim is made here. Enterprise security review, a DPA, SSO, and SCIM are available by agreement; confirm required controls with sales before relying on them.
Evaluating a company-knowledge agent for production?
Send the control questions your security or governance review needs answered.
Put a governed boundary around agent knowledge
Prove the workflow with one agent, or talk with us about a multi-team security review.
