For security, governance & engineering leaders

Approval and access enforced before retrieval

Do not ask a model prompt to remember which facts are approved or who may see them. Curated Data checks workspace, token scope, classification, and revision status before MCP or REST returns content.

Drafts excluded from retrieval
Workspace and classification boundaries
Author, reviewer, and revision history
Portable markdown and REST fallback

Enforce the boundary outside the prompt

The retrieval service authenticates the caller and filters by workspace, permission scope, allowed classifications, and approved status before returning a concept.

Keep unreviewed changes off the agent surface

Draft, rejected, and in-review revisions stay unavailable. The earlier approved revision remains current until a reviewer approves the replacement.

Make each approved fact inspectable

A stable path and numbered revision preserve who authored and approved the change, so a disputed source can be investigated without reconstructing a deployment.

Avoid a single-protocol exit

Agents can retrieve the same approved revisions over hosted MCP or REST, and the underlying concepts remain portable markdown and YAML.

Questions

Does the model enforce access control?: No. Access is enforced by the service before content is returned. The model only receives concepts that the authenticated workspace token and its allowed classifications can retrieve.
Can one token read another company’s workspace?: No. Tokens are scoped to one organization, and workspace context is applied at the same retrieval boundary that filters approval state and classification.
Can access be rotated or revoked?: Yes. API tokens can be rotated or revoked at any time, and the old secret stops working immediately. Rate limits and usage metering apply per organization.
Does Curated Data claim a specific compliance certification?: No blanket certification claim is made here. OIDC SSO is available on Enterprise; SAML and SCIM are on the roadmap. Enterprise security review and a DPA are available by agreement; confirm required controls with sales before relying on them.

Evaluating a company-knowledge agent for production?

Send the control questions your security or governance review needs answered.

Put a governed boundary around agent knowledge

Prove the workflow with one agent, or talk with us about a multi-team security review.