Graphicient: trustworthy AI that doesn't monitor your employees

A concrete use case: the HR ontology

Take an organization using the Graphicient application to connect its data to an ontology. In this ontology, an employee can manage another employee, belong to a department, be assigned tasks, hold technical and functional skills, and be the subject of performance reviews.

Business teams use this ontology to know, for instance, which tasks are assigned to a person or which department they work in. But those same relationships also allow, in a single question, exactly the kind of output that worries people: "Rank employees by their latest performance reviews."

Two independent layers of protection

This is precisely why Graphicient built the "guardrails" feature into its AI ChatBot module. It's a mechanism configured per organization to guarantee the AI assistant never becomes a tool for individual surveillance. Graphicient runs two independent protection layers — one controlled by the client organization, the other written directly into the assistant's technical instructions — each able to refuse on its own, and both must give the green light for an answer to be produced.

1st level: guardrails configurable in the application

Graphicient lets an environment's administrators declare, in the AI ChatBot menu, questions the assistant must refuse to answer, for example a productivity ranking between employees or an individual comparison of results. Unlike a generic ethics charter or a technical limit baked into the product, this protection only exists if the organization chooses to turn it on. Each organization defines its own list of blocked questions, based on its own compliance concerns, management culture, and local regulation.

Technically, this first level relies on a meaning index. If only one phrasing of a ban were stored, only that exact phrasing would be recognized — which would be useless in practice. On save, the system generates a family of equivalent phrasings in the background and stores a mathematical representation of each one's meaning. This index covers several ways the ban could be circumvented, intentionally or not:

• a rephrasing ("who produced more documents, X or Y?" is recognized as equivalent to "how many documents did X produce compared to Y"),
• a different working language (the German or English version of a banned question is caught by the same entry),
• a question diluted inside a longer text (the check isolates the question from its context before evaluating it),
• an attempt spread across several messages (the check reads the whole conversation, not just the last message),
• persistence after a refusal: follow-up attempts are evaluated against a stricter threshold for a limited time.

In parallel, a meaning index is automatically generated for allowed questions. When a ChatBot user asks something, it's compared simultaneously against both indexes (banned meanings and allowed meanings), and is only refused if it turns out to be clearly closer to a ban than to anything the environment considers normal use. This avoids false refusals: "List the documents written by Marie" sails past a ban on ranking authors.

A dedicated model also recognizes people's names in all their forms, which lets the strict standard apply to questions about individuals without wrongly blocking questions about products, parts, or codes.

2nd level: guardrails written into the system instructions

While the first level is controlled by each organization's application administrators, this second level is configured by Graphicient's technical teams at the client's request, directly in the AI's system prompt. It's not a setting a client turns on or edits from an admin panel, but a foundational rule written into the assistant's instruction code.

This instruction explicitly separates what remains allowed (looking up, listing, or filtering by a person's name) from what's forbidden (measuring people against each other), to avoid over-blocking. It judges the meaning of the produced result, not the wording of the question, and explicitly covers multi-turn constructions: a comparison assembled from several answers obtained separately is still a violation. The difference in nature between the two levels, one editable by the client through an interface, the other carved into technical instructions, is precisely what makes the mechanism hard to bypass from the inside: even a malicious administrator can't disable the second level.

How a question is processed, in two steps

Conceptually, a question follows a two-step path: if the first protection level recognizes it, it's refused immediately, without even being processed. If it clears that first level but the output the assistant was about to produce amounts to evaluating people, the second level steps in and refuses that part, while still answering what remains allowed. The full answer is only delivered if both levels give the green light.

What the assistant accepts, what it refuses

Back to our example. Here are sample questions accepted and refused by the ChatBot under both protection levels.

Now imagine the administrator adds no guardrail in the ChatBot interface: the system instructions then take over to control user questions.

The limits of this protection

Does this protection slow down the chatbot? No: as soon as a question comes in, the assistant starts processing it immediately while, in parallel, the first protection level compares its meaning to the ban list. If nothing is detected, processing continues without any delay; on a match, it's interrupted and replaced with a refusal.

Is this protection absolute, then? No. Graphicient's configurable guardrails block questions, not knowledge. If two questions are each individually allowed (getting the list of documents for person A, then, in a separate conversation, those for person B), nothing stops a user from combining those two answers themselves into a de facto comparison. This is an accepted limit: closing it entirely would mean also banning the single-person question itself, which is a policy decision each organization must make on its own.

Governance built to last

This feature imposes nothing fixed in time. Each environment's administrators keep control of their banned-question lists, with updates taking effect immediately, without requiring any technical deployment from Graphicient.

It's hard to tell, just by reading a list of bans, whether it's well calibrated: too loose, and workarounds slip through; too strict, and it blocks perfectly legitimate uses. That's why Graphicient guides its clients through a calibration procedure before a new policy goes live: it automatically replays a battery of "must block" and "must pass" questions against the environment's real configuration, and reports, entry by entry, whether the observed behavior matches the administrator's intent.