Fail-closed permissions
Every fact in the graph carries its ACL. Retrieval is trimmed to what the asker may see before an answer is synthesized. On any doubt, the brain stays silent.
The wrong person never sees the wrong thing, by construction.
Permissions aren't a filter we add at the end. Every fact carries its ACL, every read is trimmed before an answer is written, and every access, human or agent, lands in a tamper-evident log.
Agents, scoped the same
Agents act on behalf of a person or team through scoped principals with signed keys. An agent can never see more than its owner. No security review per automation.
Bi-temporal audit
Every answer carries provenance and a valid-as-of date. Facts are versioned, never overwritten. Reconstruct what was known at any past date.
Hash-chained evidence export
Every access is recorded with its principal, the documents touched, and the allow/deny decisions behind them. One click exports a self-verifying, hash-chained compliance bundle mapped to SOC2 controls. Weeks of audit evidence, in an afternoon.
Trust Center
See your permissions posture and preview “who can see what” before you grant or share. The costly mistake, caught before it happens. Offboarding runs fail-closed too.
You choose what leaves
Retrieval runs on a local hashing embedder — no document is ever sent to an embedding API. Reading documents into the graph and writing answers do call your configured model. Leave that key unset and slashh runs entirely offline on rule-based extraction.
Same brain. Same question. Two people, two answers.
“Why did we change the refund policy?” Someone in leadership and a new hire ask the same thing. Retrieval is trimmed to each person's ACL before the answer is ever written. The new hire is even told that something was withheld, never what.
Leadership
The full rationale from the leadership-only channel: cited, with the decision, owner, and date.
New hire
The public policy change only. The trace records that results were withheld: logged, never leaked.
Where we are, plainly
Private preview. Three things we'd rather you heard from us.
- The access log lives in the running server's memory today, so it does not survive a restart. Durable retention is what we're building next, and it gates using this as your system of record.
- We are not SOC2 certified. What ships is the evidence machinery — the control mapping, the signed bundle, the export — not an attestation.
- Sign-in is AWS Cognito. Groups come from your identity provider's token; SCIM directory sync isn't built yet.