Same identity
Copilots work as the signed-in person, not a service account named AI.
Knowledge Engine
Similarity is not a right.
Collect, structure and connect knowledge from documents, data, people and processes — searchable, citable, and refused when the caller could not have opened the source.
Additive ingest
A new version does not erase history.
PDF, CAD, sheets, mail, databases and portals stream into private memory: citable pieces, a map of how they relate, a trail of versions. Previous memory is deactivated as current knowledge; restore can bring back what the person may still see.
Empty files are not indexed as if they were content. Delete, move, retain-until and expiry update what may be retrieved. Audit still knows what existed.
Retrieve
Over-fetch, then refuse.
The engine finds pieces that mean something like the question, situates them among related work, then keeps only what the same permission check would allow in the product.
Citations point back at the live file or record. Payroll and similarly excluded subjects never enter that memory.
Meaning above tables
The core does not marry one database schema.
It declares what the organisation means — customer, project, document, evidence, asset — and how those things relate. Hosts project their own tables into that language.
Change the labels and the connectors, keep the retrieve and Confirm loop. That is why the core can develop instead of being rewritten.
Security is the product
If you could not open it, the model cannot quote it.
Host ACL
No parallel security model. Policy reuses the host’s roles and section rights.
Confirm on writes
Memory proposes; people commit. Trails export.