Security

Defence in depth

Layer	Control
Identity	Sign-in through your IdP with enforcement, groups synced from your directory, no Lucy passwords
Tenant separation	Every object belongs to one organisation. An ID from another organisation returns `404`.
Authorisation	Roles (`member`, `org_admin`, `auditor`), per-feature grants, per-tool permissions `allow` / `ask` / `deny`
Execution	Code runs in microVM sandboxes with their own kernel, no route to internal networks, no secrets inside
Egress	Sandbox internet off, allowlisted or open per organisation. The allowlist is enforced by the platform’s network policy.
Secrets	Connector tokens sealed with a key held outside the database, never returned by any API, never visible to the model
Encryption at rest	Application secrets are encrypted today. Encryption at rest of conversation data, files and saved workspaces is under review. See Encryption and secrets.
Actions on others’ behalf	Approval cards before mail is sent or invitations go out
Third-party servers	Public https only, DNS re-checked on every call, size and time limits, changed tools need admin review
Accountability	Non-editable audit log, auditor role, exports
Spend	Per-person limits, organisation budget, alerts

Risk	Settings that reduce it
Data leaves through code	Sandbox No internet or allowlist
An assistant sends something it should not	Send mail app off, or tools `ask`
A compromised document tries to steer Lucy	Sandbox isolation, `ask` on writes, tool review
Over-retention	Retention settings, shortest wins, member removal
Unauthorised access	IdP enforcement, roles, groups
Runaway cost	Limits, budget, alerts
Unreviewed changes	Audit log, auditor role
Unmanaged automation	Agents off by default, own connections, `ask` becomes `deny`