A model that writes well is easy to find. What is hard is making its output survive the question “where did this number come from”, six months later, in front of an auditor. This is the engineering behind that.
The four decisions that matter most
Only reads what is permitted
Retrieval runs inside the workspace boundary and under the asker's permissions, not across everything.
Answers carry citations
Each answer brings the passage it leaned on. You read the source rather than take our word.
No source means no answer
Without reliable evidence it says it cannot answer. That is correct behaviour, not a failure.
Personal data is masked
Masked before it is stored and before it reaches an answer. Images and scanned PDFs are the exception: the file itself goes to the OCR service, and only the masked transcription is kept.
Where a question travels
- 01
Identify the asker
Who, in which workspace, allowed to see what
- 02
Find sources
Only within what that person may read
- 03
Compose the answer
With a passage behind each point
- 04
Check before returning
If the evidence falls short, it refuses and says why
What an answer looks like
The difference is the last two rows. An answer does not stop at the text; it carries the document, the reference and the passage it leaned on. When somebody asks where a number came from, the answer is inside the answer, rather than something to reconstruct six months later.
- Question
- Under FOB, who carries the risk?
- Answer
- Risk passes to the buyer once the goods are on board the vessel at the port of shipment.
- Source
- Incoterms 2020 §A3 · FOB
- Passage
- “risk transfers once the goods are on board the vessel”
- If no source
- It refuses, and says why
Illustration · Illustration, sample data
Model spend has a ceiling
Each workspace carries its own cap for document reading and model calls. At the cap the paid call is refused before it runs, the screen says it is blocked, and the manual path stays open. It does not quietly return worse results.
Try a real question
The Copilot on the home page calls the product's own API. Ask it something hard and watch it answer or refuse.