Security and auditability

Security starts with narrow source credentials and continues through every answer and integration.

Baseline controls

• Use read-only, least-privileged source accounts.
• Encrypt connection credentials at rest.
• Keep API keys and embed signing secrets server-side.
• Require explicit tenant scoping for shared customer data.
• Bound operations by timeout and result limits.
• Review plans and provenance for high-impact decisions.

Logs and evidence

Use Logs to investigate authentication, planning, execution, and administrative activity. Retain records according to your organization's policy and plan capabilities.

Human approval

Require review before broadening source access, changing semantic definitions, publishing external embeds, or enabling tools that can change external systems.

Answerplane helps enforce and record policy. Your organization remains responsible for source permissions, data classification, and access review.