Part 8 - Security Is Shipped, Not Promised

Every AI product has a security page. Almost none of them has a security register.

The difference is the whole post.

A security page is a promise: encrypted in transit, SOC-something in progress, we take your privacy seriously. A register is a list of what was actually found, when, and what closed it. One is written by marketing. The other is written by whoever got paged.

My situation was that I was about to ask people to put their working email and their AI discussions into a system that an AI would read and write. There is no version of that request that a promise can carry. The only thing that can carry it is a record.

So the system is attacked before it ships. Twenty years of infrastructure work taught me to audit my own product the way an adversary would, and the classes of failure that break AI products, injected instructions riding in on content, credentials leaking through the wrong layer, endpoints that trust the caller, were treated as design inputs, not incident categories. The register that came out of that discipline is a living document with an inventory of every external entry point into the system, and it gets longer, because auditing never stops.

The fixes were structural rather than patches. No credential ever enters the model's context, because tool access is derived from one canonical registry, scoped to the session, that rebuilds itself from a single source file on every cold start and is never hand-edited. Workspace boundaries are enforced at the database layer on every query, so isolation does not depend on the application remembering to check. The infrastructure fails closed: when something is wrong, the answer is no, not maybe.

Encryption is on, with a per-workspace key the database itself cannot read, and search runs over the encrypted content without decrypting it on the way. The register even has a closed line item to show for it: a batch of early rows predated the encryption path, the register said so while it was true, and the migration that encrypted them closed the entry. A security page would have said "encrypted" the whole time. The register earned the word.

One last mechanism, because it is the one that keeps a register honest over time. Every operating constant in the system, every timeout, batch size, and threshold, was audited and promoted to administrative configuration with automatic drift checks, so a security-relevant tuning change does not require a code deploy and cannot quietly diverge from what the documentation says. You cannot keep a register accurate if the real values live in someone's editor.

The test for trust in an AI product is not whether the vendor sounds careful. It is whether they can show you the list. Ours is maintained, it has entries, and it will have more. That is what shipped security looks like from the inside.

Context Windows Close. AI Forgets Everything. Your Work Should Never Start From Zero.

MrAgentˣ is in private beta. Limited to the first 1,000 until launch.