Built so your ops data — and your AI — stay in your control.
Scoped tokens, workspace access controls, audit records, AI write controls and approval gates are shipped in the current platform. Where a control is implementation-scoped or limited to a specific workflow, we say so rather than presenting it as universal.
Scoped REST tokens
Agent API tokens carry fine-grained scopes — events:read, events:write, site_map:read. Each token is signed, owner-attributed and revocable.
No shared passwords
Operators sign in with their own account. Agents and integrations use their own scoped tokens. No one logs in as anyone else.
Token rotation & revocation
Rotate or revoke tokens at any time from Settings → Agent API. Old tokens stop working immediately; audit log preserves what they did.
Enterprise identity requirements
SAML/OIDC SSO is implementation-scoped, not a self-serve shipped control. Enterprise identity requirements are assessed and agreed during implementation.
Workspace RBAC
Workspace roles enforce owner, operator and view-only boundaries. We do not present arbitrary custom roles as generally available unless they are implemented for the deployment.
Audit logs
Every sensitive action is logged with actor, scope, change and timestamp — UI, AI and Agent API calls included.
Data export
Your data is yours. Export clients, events, crew, inventory and finance anytime in CSV.
AI write controls
The assistant runs read-only by default. An owner toggle in Settings turns on write — and turns it off the same way.
Approval workflows
Sensitive actions can require explicit human sign-off before the AI or an agent commits the change.
Integration sandbox
Simulation currently exists for supported integration workflows, including demo/sandbox connections. It is not a universal preview mode for every platform write.
Data access boundaries
Row-level security at the database layer. Multi-tenant by design — your workspace is your boundary.
Enterprise review
Custom plans can include implementation, support and procurement/security review terms by agreement. Specific SLA, DPA and identity requirements are confirmed contractually, not assumed.
How AI write access works in practice.
On a free first event the assistant is strictly read-only. It can answer, summarise and surface gaps — but it cannot change a thing.
On Operations and custom plans the workspace owner can turn on write access from Settings. Once enabled, the assistant can update milestones, create events and change pin statuses — but only inside the requesting user's permissions, and only inside row-level security boundaries.
Every write is logged with the prompt, the change, the actor and a timestamp. You can review the audit log at any time, and revoke write access with the same toggle that enabled it.
Want a deeper security walkthrough?
Book 30 minutes with the team. We'll distinguish shipped controls from implementation-scoped requirements and answer procurement and security-review questions.