Trust · Protected domainsProtected
Finance is granted to a person, never a role
Some data should be visible to one named person and nobody else, however senior. Brigham.ai enforces that in every layer, in code.
Admins get nothing by being admins.
Workspace admin and super admin roles confer no access to a protected domain. Only an explicit per-person grant does, and only the owner of the domain can give it.
Enforced at every layer
Tools and connections
Each carries a domain. The pipeline refuses a protected tool or connection for anyone without a grant, and audits the refusal.
Memory and documents
Content carries a domain label. Retrieval filters on it in the database before ranking, so protected content never reaches someone else’s context.
Admin and support views
Run lists, usage and audit search hide protected rows from people without a grant and show counts only.
Automations
Run as their owner. One person’s briefing can’t contain another person’s protected data.
The label follows the data
Touch
A conversation reads protected data. That conversation becomes labelled.
Inherit
Its messages, run events, tool executions and audit rows inherit the label.
Propagate
Anything derived from it inherits too: summaries, memory candidates, briefings and delegated subtasks.
Stay
Labels are only ever added automatically. Removing one takes the domain owner.
Rules of the grant
- Source of access
- An explicit per-person grant
- Derived from role
- Never
- Who can grant
- The domain owner only
- Changes
- Every grant change is audited and notified to the owner
- Delegation
- A grant can’t be passed to an agent acting for someone else
- Covered by default
- Accounting, banking and payment data, and billing records
Questions, answered.
Is this configurable for my workspace?
Yes. Workspace admins manage integration and protected-domain permissions for your workspace. Grants still come only from the designated owner of the domain, never from a role.
How is it tested?
A super admin without a grant calling a protected tool must be denied and audited. Protected memory must never appear in their retrieval. A summary derived from a protected run must inherit the label.
Keep reading.
Keep the books closed
Request access to see how a protected domain behaves for admins.