
Access before retrieval.
A permission-scoped retrieval demonstration. A document outside the selected role's access is never a candidate for the answer. Production identity and permissions integration remain separate work.
Poisoned content induced a simulated email action addressed to an attacker. The action gate blocked it before execution.
Read technical note
61 deterministic security and retrieval evaluations cover eight documented threat classes and retrieval behavior. CI exercises three supported combinations of Qdrant or pgvector backends with native or LangGraph runtimes, without model calls. Per-session and per-IP spend caps bound model cost. The demo uses a role switcher and simulated side-effecting tools; real-world effects cannot execute through those simulated tools.



