Trust & Security
Replayable authorization: rewinding a security decision
Any past AI data access can be re-derived and re-checked — as of then, and as of now.
Most systems can tell you that data was accessed. Very few can prove the access was correct — that the permission rules, as they stood at that exact moment, genuinely allowed it. This platform can, because it keeps two things most systems throw away: a proof of each decision, and the history of the rules themselves.
The proof: a sealed envelope per query
Every time the AI retrieves tenant data, the platform first resolves the complete set of records that user is allowed to see — their security envelope — and logs a cryptographic fingerprint of it, together with what was actually retrieved, into the tamper-evident chain described in Tenant logging. The decision isn't just made; it's notarized.
The history: the rules remember themselves
The tables that permissions are computed from — user membership, roles, location assignments, and the records' own state — keep full, engine-native version history. The platform can therefore reconstruct exactly what the rules said at any past instant, the way you'd rewind a film to a frame.
Replay: two questions, two modes
| Mode | Question it answers | What a failure means |
|---|---|---|
| As of then | Re-derive the envelope under the rules as they stood at that moment. Does it match the logged proof, and was everything retrieved inside it? | Tampering, an enforcement bug, or a forged log entry — something that demands investigation. |
| As of now | Re-derive the envelope under today's rules. Would that same access still be permitted? | Not a violation — drift. Access that was proper then but wouldn't be today (a role change, a departure), which is exactly what a periodic review should surface. |
Each replay produces a recorded verdict — verified, mismatch, unauthorized retrieval, no longer authorized, or chain broken — and replays themselves are logged, so the checking is as accountable as the thing checked.
Why this matters
When a customer, auditor, or regulator asks “did the AI ever access something it shouldn't have?”, the answer here isn't a policy document — it's a procedure: replay the period and read the verdicts. And the as-of-now mode turns the same machinery into hygiene, catching permission drift before anyone asks.
The replayable window equals the retention of the rule history. Longer retention means further back you can rewind — a deliberate compliance dial, set per posture.
Capability review: 2026-09-14. For exact current technical availability, use the generated API Map and first-class module inventory.