DocsDiscover SovereignSecurity and compartmentalization
Loading documentation, please wait.
NEMORIONDocsNEMORIONDocsRunning an application on your own infrastructure gives you control over its environment. Useful security also requires control over the information and actions inside it.
Sovereign separates administration, content access, and individual operations so an organization can share what people need without automatically opening the rest.
Managing a workspace and reading its content are different permissions. Management authority does not automatically grant content access in Orbit's workspace, work item, and document model.
This allows an organization to assign operational responsibilities separately from participation in the work. Content access requires the appropriate additional grant.
Authority to change access is itself significant. An administrator who can grant permissions may be able to change the audience; separation of management and reading is not a claim that administrators can never authorize additional access.
A person may need to complete one task without seeing the larger initiative it supports. Orbit's work item permissions allow access through assignment or a direct grant without that grant opening the parent work item or workspace.
For example, a specialist can receive the task they need, discuss it, and move it through its status workflow. Access to related work remains a separate decision.
Inherited permissions still matter: a person who already has broader workspace access retains that access. A narrow assignment does not remove permissions they hold elsewhere.
Sovereign's authorization model distinguishes the actions someone may perform on an entity.
Five prominent examples from the platform's 14 authorization verbs are:
While the model can be applied to any application entity, the permissions currently exposed and enforced depend on the entity. Not every entity implements every verb, and some permissions imply others according to the entity's rules, such as editing also allowing reading.
A concrete example using Orbit's documents - A person can be allowed to discover a document without reading it, or read it without permission to edit or share it. The document folders in Orbit can also form access boundaries: an isolated folder can stop content access from flowing down from its parent, allowing its audience to be granted separately.
Using an AI assistant should not silently replace a person's access with the broad privileges of a platform or service account.
The on-behalf-of model keeps the represented user distinct from the service making the request. For exammple, a permission-aware document retrieval. When an AI assistant queries for documents, the intended boundary is the user's readable content, before that content reaches the model.
Separately authorized automation uses a different authority model. Delegated authority explains that distinction and the Workflows design.
Audit records capture security-relevant actions and outcomes. Observability provides logs, metrics, and traces for understanding application behavior and diagnosing failures.
The platform's identity and audit model distinguishes service callers from represented users. That distinction preserves attribution when a service acts on a person's behalf.
When evaluating an installation, review the events captured and the storage, access, and retention configuration that will make those records useful to your organization.