TAG separates AI reasoning from the authority to act.
An intelligence layer sits above the systems that run your business. That is a position of enormous trust, and it is the reason the boundary between what the system may conclude and what it may do is drawn explicitly, in writing, before anything connects.
This page is written for the person who has to approve TAG — a CIO, a CISO, a head of IT, a risk committee. It states the controls plainly, and it distinguishes what TAG commits to inside your environment from what is already built into the platform TAG runs.
Reasoning is not authority
A model may read, correlate, rank and recommend. Acting — writing to a system of record, sending a message, moving money, changing a customer state — is a separate permission, granted deliberately, scoped narrowly, and logged. A recommendation that nobody approved is a recommendation, not an action.
Recommendations are proposals
Intelligence produced by the layer is presented for a decision. Nothing reaches a system of record because a model was confident.
Action is separately authorized
Every workflow that can write, send or change something is enumerated, scoped, and approved by name before it is enabled.
Approval is human where it matters
Consequential actions carry a human approval step. The approval is part of the workflow, not a setting somebody can quietly switch off.
Every action leaves a record
What was recommended, what evidence supported it, who approved it, what happened, and what changed afterwards.
How TAG connects to the systems you already run.
These are the commitments TAG operates under in a client engagement. They are agreed in writing before any connection is made.
Access
- Read-only access wherever the workflow does not require writing.
- Least privilege by default: access is scoped to the specific data a workflow needs, not to whole systems.
- Credentials are created, held and revocable by you. You can withdraw TAG’s access without TAG’s cooperation.
- Role-based access on TAG’s side, so an individual’s access ends when their involvement does.
Data
- Your data stays within the environments agreed in advance. Moving it anywhere else is a change that requires your approval.
- Encrypted in transit and at rest across the platforms TAG operates on.
- Personal data is minimized: a workflow receives the fields it needs and not the record around them.
- Retention and deletion are agreed per engagement, in writing, including what happens at the end of one.
AI boundaries
- No uncontrolled uploads to public models. The providers in scope are named, and changing one is a documented decision.
- Model and provider boundaries are explicit: which model sees which data, for which task, under which terms.
- Deterministic logic is preferred wherever it is sufficient. A model is used when judgment is genuinely required, not by default.
- Prompt content is treated as data, never as instructions from a trusted source.
Evidence and oversight
- Source lineage: every figure traces back to the system and record it came from.
- Audit logging of what the layer read, recommended, and did.
- Incident handling with a named contact and an agreed notification path.
- Measurement after the fact, so a claimed outcome can be checked rather than believed.
Controls that are already built, not planned.
Everything below exists in the running system. It is listed because a security review should be able to check claims, not weigh adjectives.
Data boundary
- Row-level security is enabled on every application table, with no policies and public roles revoked — a leaked public API key reaches nothing.
- The privileged database credential is server-only. It is never shipped to a browser, and production source maps are disabled.
- There is no public read API. No endpoint enumerates leads, subscribers or submissions.
- The website holds no customer business data. It never connects to a client system.
Handling of personal data
- Visitor IP addresses are never stored. They are hashed to derive a rate-limit key and a consent proof, and there is no table with an IP column.
- The email delivery ledger stores a hash, not the address.
- Consent records the policy version and the exact wording shown at the time.
- Unsubscribe uses an unguessable token, and the endpoint answers identically whether or not it matched.
Failure behaviour
- A request is captured durably before any downstream side effect, so a mail or calendar outage cannot lose it.
- Email provider selection fails closed. If a named provider is incompletely configured, delivery falls back to a mock rather than silently sending through a different real provider.
- Rate limiting is authoritative across every server instance rather than per-instance.
- Where persistence is unavailable in production, conversion paths fail closed instead of accepting data they cannot keep.
Transport and email
- A Content-Security-Policy that permits no third-party origin beyond the two the voice concierge requires.
- HSTS with preload, framing denied, MIME sniffing disabled, camera and geolocation denied outright.
- SPF with a hard fail, DKIM, and DMARC set to reject on the sending domain.
The voice concierge
- Taylor has no tools. She cannot read a CRM, book a calendar, send anything, or change a record — and is instructed never to imply otherwise.
- Voice credentials never reach the browser. A visitor receives a short-lived token scoped to a single room.
- The microphone is enabled only after an explicit click, and only for the duration of the session.
- Durable transcript capture is off, fail-closed behind a privacy release gate, and Taylor operates normally without it.
Published claims
- A figure cannot be published on this site because somebody typed it into a page. It passes typed evidence metadata, a build-time gate, and a database constraint requiring a named approver.
- Where a result has not been approved for publication, the site shows no number rather than an estimate.
Bring your security review to the first conversation.
If your organization has a vendor security questionnaire, a data-processing agreement, or an architecture review board, that is the right place to start rather than the last hurdle. TAG would rather answer the hard questions before a connection exists than after.