Inside the AI office

Rufous connects a company through personal workspaces. Start with the top row: mail, files, and calendars pass through ingestion workers into a separate search index for each employee. Mail synchronization remembers where it stopped. File ingestion tracks paths and content changes. The assistant searches this prepared context, while source links let the employee open the underlying record.

The middle row is the answer path. The employee workspace starts a bounded agent process inside its own execution sandbox. It can see its session files and application code, but not the company stores or signing keys. Authorized records come through a separate tool gateway. The model runs on a private inference host reached through an encrypted tunnel. Prompts and selected context stay within these controlled hosts; there is no external model fallback.

The lower row connects assistants and makes work visible. A durable coordination service carries requests and matching replies. Operational evidence feeds the office view, including service readiness and actual work in progress. Management sees aggregates, and IT sees operational health. These are separate views of the same system. The moving lines explain the architecture; the live office is where you inspect current activity.

A company boundary starts before the assistant opens. The private HTTPS gateway verifies the network account and checks an explicit allowlist. It signs each request, and the application rejects forged or replayed identity claims. Company accounts are pinned to their assigned employee, role, and agent. Our approved demo reviewer can explore fictional employees; that separate review mode does not grant real employees a persona switcher.

An agent turn runs in its own filesystem and process sandbox. It cannot directly open company databases, other employees’ session files, or signing keys. Its short-lived grant goes to a separate data gateway, which checks permissions before each operation. The application network has no default route. Only fixed mail and private inference gateways are reachable. The model runs inside our controlled infrastructure, reached through an encrypted tunnel, with no external provider fallback.

Personal knowledge, shared collections, mail, indexes, and durable messages live on an encrypted volume. Its unlock key is sealed to the host’s security hardware. Backups are encrypted before leaving the host, and a restore is checked against the stored files and indexes. Host administrators and the trusted data services can still read mounted state. Those are explicit trust boundaries. Access policy changes revoke entry on the next request, while recovery procedures preserve the company’s records.