From question to verified answer

Follow one employee question. First, the server checks the signed browser session and intersects the person’s permissions with the agent’s current organization scope. Only the overlap is allowed. The turn receives a short-lived signed grant and a trace identifier. In this demo, people select a persona to explore the experience; that selection is not enterprise single sign-on.

The bounded agent turn receives the conversation and its access grant. When it calls a tool, the tool independently verifies the signature and applies the access boundary again. A document search reads only the permitted personal index. Invalid or insufficient grants are rejected. The model can request an operation, but the tool decides whether that operation is allowed.

A successful authorized tool call leaves an execution receipt. The server requires that evidence before returning the answer, and citations let the employee inspect the source. A trace proves that a tool ran; it does not guarantee every sentence is correct. If the task creates a draft, a person can review it. Approval records the decision; external email delivery remains disabled in this demo.