Security
How we keep agents safe.
Five controls built into the foundation, so agents can move fast on real systems without breaking things.
Enterprise-grade means provable.
Agent request
Your systems
01
Identity passthrough
Agents act as the person who asked.
02
Guardrails
Thresholds, approvals, scoped access.
03
One gateway
Every agent call logged and checked.
04
Monitoring
Anomalies quarantined automatically.
05
Immutable audit log
Reconstruct anything, always.
Security architecture, layer by layer.
The controls reinforce one another: tenant isolation constrains identity, identity constrains tools, tools run through one gateway, and every result lands in the ledger.
01 · Live
Tenancy and identity
Workspaces are hard boundaries for data, agents, and budgets. SSO, SCIM, and MFA bring humans in. Identity passthrough ensures every agent action inherits the requester’s real permissions.
02 · Building
The governance gateway
Every model call and tool call crosses one enforcement point. Typed tools, capability gates, job envelopes, and the call broker decide what runs, what waits, and what gets blocked.
03 · Live
Propose-only by default
Autonomy is earned per action, never granted globally. Threshold breaches enter approvals, the approver is recorded, and access can be revoked instantly.
04 · Deepening
Treat inbound content as untrusted
Supplier mail, documents, and spreadsheets never become instructions. Redaction runs before model access, retrieval stays scoped, and taint tracking is moving from design into the product.
05 · Live / Building
A model-agnostic AI gateway
Cloud models run under enterprise terms with workspace caps. Sovereign mode keeps the same gateway contract while open-weight models run inside the customer boundary or on dedicated in-country capacity.
06 · Live
The memory of everything
Every read, tool call, proposal, approval, and execution lands in an append-only ledger. Trace-level observability supports investigation, quarantine, SIEM export, and audit review.
One Chokepoint · No Side DoorS
01
Identity + workspace
Who is asking, and where?
02
Job envelope
Scope, tools, budget, autonomy.
03
Broker + tool catalog
Allow, block, or request approval.
04
Execution + ledger
Result, approver, evidence, trace.
Data residency
On-prem deployment means your ERP data, mailboxes, and contracts stay inside your network boundary. KVKK and GDPR obligations get simpler when the data never travels.
GDPR
KVKK
Attestations
ISO - 27001
Approved
SOC - Type II
In progress - Target Q4 2026
TiSAX
In progress - Target Q4 2026
or email sales@spaceflow.tech
