Schema-level access control

Silos protected by accident

As long as a contract, an amount or customer data stayed locked in its original tool, it was known to a small number of people. By reconciling silos into a single graph, this accidental protection disappears — and connecting information that never used to cross paths can even surface sensitive data that wasn't sensitive individually.

Security is therefore not an option you switch on tool by tool. It's embedded in the very structure of the data.

The confidentiality level is declared in the ontology

Before feeding the graph, a master schema is defined: what types of elements exist, what links connect them, what attributes they carry. It's at this level, and nowhere else, that confidentiality is set: the "Contract" type is confidential, the "amount" attribute even more so, the "Customer" type stays accessible to all.

One configuration only

No need to tag every contract one by one: once a type is classified, all its instances inherit the rule.

Valid for tomorrow too

A contract created today and one created in six months follow the same rule, with no manual action.

No grey area

Data already present inherits the default level of its type, exactly like new data.

One access level per context, never a global access

Every user starts at the lowest level: only non-sensitive information is visible to them. Each context's administrators then widen their rights according to their actual legitimacy.

The same user can therefore have broad access on the project they lead and restricted access on one where they only provide support. Access granted for a one-off need never turns into permanent, blanket access.

When a graph is shared to another context, each user keeps their own level: the same graph appears detailed to some, anonymized to others.

Filtering on every query, in real time

Right before sending the response, the system compares each piece of data's confidentiality level to the user's access level in their context. Every user literally receives their own version of the graph, including when they ask the question in natural language to the AI assistant.

If an attribute is too sensitive, only that attribute is masked. If it's a whole node or link type, the element isn't removed but anonymized as "******". 

Digital continuity

Rather than making data disappear, the system preserves the topology: even filtered, the graph stays coherent and navigable.

Scalable architecture

Adding a confidentiality level doesn't require a rebuild: you enrich the existing hierarchy.

Demonstrable compliance

Model, rights and filtering are three separate building blocks: for an audit, presenting the ontology and the assignment rules is enough.