Architecture
Your board decides what the model sees. Including nothing.
EGP was built permission-first. Everything else — including whether AI participates at all — is a decision the board makes, enforced by the architecture and written into the contract.
Before anything else
AI is a feature here, not a dependency.
Most board portals are sold on their AI. If a board says no, there is no graceful answer, because the assistant is the product. EGP works completely with it switched off — so the first question is not what the model can do, but whether it participates at all.
Off
No inference, anywhere, for anyone. The portal is complete without it — packs, meetings, minutes, resolutions, entities and compliance all function unchanged.
Scoped
On for the main board, off for Audit and Remuneration. Each committee's material is governed separately, because sensitivity is not uniform across a board.
Excluded
A classification set at upload that marks a paper permanently unreadable by any model. Enforced at retrieval, not by policy — the M&A paper is structurally excluded.
Full
CASA across the whole archive, within each caller's grants, citing every source. What most boards land on once they understand the boundaries.
The mechanism
The model is a principal.
There is no separate AI permission system to keep in step with the real one. Inference is subject to the same access graph as a person — it holds grants, and it can be granted nothing. Excluding a paper from AI is the same operation as excluding it from a director.
The commitment
Written into the order form.
A switch is a setting; a contract term is a commitment. Where a customer elects no AI processing, or excludes a committee, that election is contractual rather than configurable — and customer data never trains a shared model under any setting.
And when it is switched on
Filter before you generate, not after.
Once a board does let the model participate, the same question applies one level down: what is it allowed to read? That choice is architectural. It cannot be retrofitted with a setting.
Generate, then redact
The retrofit
- 1Retrieve across the whole corpus
- 2Generate an answer from everything found
- 3Attempt to strip what this user should not have seen
The model has already read the restricted material. The filter is downstream, best-effort, and the failure mode is disclosure.
Filter, then generate
How EGP works
- 1Resolve this caller's grants first
- 2Retrieve only within what those grants permit
- 3Generate from that set, and cite every source
Restricted papers never reach the model. The failure mode is an answer that is too narrow — and the system says so, naming how many sources were withheld.
This is why the same question, asked by two directors, returns two different answers — and why you can see exactly which grant caused the difference.
The stack
Four layers, each assuming the others will fail.
Identity
Enterprise identity is the boundary, not an afterthought bolted on for procurement.
- SAML 2.0 and OIDC single sign-on, configured per tenant
- SCIM provisioning, so leavers lose access when HR says so
- TOTP multi-factor with enrolment, challenge and recovery
- Live session inventory with single-click revocation of every other session
Data
Board material is the most damaging data in the company to leak, and is treated that way.
- AES-256 envelope encryption at rest, TLS 1.3 in transit
- Tenant isolation enforced at the storage and compute layer
- Short-lived signed tickets for document and stream access, not long-lived URLs
- Configurable regional residency for organisations that require it
Access
Permission is a first-class object you can inspect, not a property scattered across records.
- Grants modelled explicitly as principal → container edges, with allow and deny
- Access Explorer renders the full graph — no reconstruction from logs required
- Break-glass elevation is requested, approved, time-boxed and recorded
- Watermarking and remote revocation on distributed packs
Operations
Most breaches are operational failures, so the operational layer is part of the security story.
- Immutable audit trail across every document, decision and access event
- Dead-letter queues on notification delivery — nothing fails silently
- Offline director briefcase with device registration and sync state
- Accessibility held to WCAG AAA, because unusable security gets worked around
What “platform” should mean
A platform is one permission model, not one price list.
Bringing separate products under one brand, one login and one contract is a commercial decision. Bringing them under one permission graph is an architectural one. Only the second changes what the software can actually do.
Three questions worth putting to any vendor
Does one grant govern a board paper, a subsidiary record and an audit finding?
Or does each product keep its own answer, reconciled by an integration that runs overnight?
When a director leaves, how many systems have to agree they are gone?
One revocation should end access everywhere. Anything else leaves a window, and windows are where breaches live.
Can you see the whole access graph in a single view?
Or is it reconstructed per product, from logs, by someone who already knows where to look?
EGP answers all three the same way, because entities, resolutions, packs, compliance and audit were built against one access graph rather than integrated afterwards.
Deliberate constraints
The things we decided not to build.
A security posture is defined as much by what a system refuses to do as by what it offers.
Customer data never trains a shared model
Not as a configuration option that an administrator could switch on. There is no path by which one tenant's board papers influence another tenant's outputs.
No feature depends on AI being enabled
Assembly, distribution, minutes, resolutions, registers, compliance and audit all work with inference switched off. A board that declines AI is not given a degraded product.
No long-lived document URLs
A link to a board paper that still works after the meeting, forwarded to a personal address, is the most common way board material escapes. Access is ticketed and short-lived.
AI never decides who may see something
Access decisions are made by the permission layer before retrieval runs. The model has no view into what it was not given, and no ability to widen its own scope.
No silent failure paths
A reminder that did not send, a sync that did not complete and a notification that dead-lettered are all visible. Governance software that fails quietly is worse than none.
For your security team
The full documentation set is available under NDA.
Compliance posture, control mappings, subprocessors and deployment options are published openly. Penetration test summaries and architecture detail go out under agreement.
Start a conversation
Tell us what is slow, expensive, or invisible in your operation.
We will tell you honestly whether AI is the right answer — and if it is, exactly what it would take to get there.