Zero Trust and Access Control
Zero Trust architecture governs access to Looplex resources according to identity, permissions, and the context of each operation. Being connected to an organization’s network or using an authenticated account does not, by itself, grant access to all its documents and services.
This approach applies to users, service accounts, integrations, and AI agents. Its purpose is to allow only the access needed for authorized work and to limit the effects of compromised credentials or improper operations. NIST’s definition of Zero Trust emphasizes protecting resources and withholding implicit trust based solely on network location.
Identity and Authorization
Authentication verifies the identity used to access a service. Authorization determines what that identity can do with a specific resource. The platform checks both conditions at access points and when operations are performed.
Permissions take into account the organization, assigned roles, and the scope of the resources involved. Access to a case management system, for example, does not imply authorization to view all documents or modify any record.
Looplex uses strengthened authentication for administrative access and multifactor authentication for privileged or remote access where supported and appropriate to the risk. Integration with identity providers and additional authentication policies depend on the solution adopted.
Multifactor authentication, passwordless authentication, and password update policies are distinct mechanisms. Adopting one does not automatically determine the others.
Least Privilege and Separation Between Organizations
The platform limits operations to the permissions needed by the identity and activity. Authorization controls are applied in the services that retrieve or modify resources, including requests made through integrations.
Logical separation between organizations covers data, documents, and execution resources. Queries against the collections and indexes used by AI respect this boundary and the permissions on retrieved content.
Administrative permissions, support access, and integration credentials have defined scopes. Their granting, review, and revocation follow the needs of the activity and the parties responsible for administering them.
Service Accounts and AI Agents
Automated executions use identities and credentials appropriate to their purpose. Service accounts, keys, and tokens are subject to controls over scope, duration, and exposure, without relying on secrets being included in instructions sent to the model.
When a user delegates work, the execution receives permissions consistent with the authorization granted and the organization’s policies. It may operate with a narrower scope than the user’s overall access. Work initiated by events or routines uses the service identity and permissions defined for that workflow.
The agent requests operations within this scope. The responsible services verify authorization before performing them. An instruction found in a document or produced by the model does not expand the agent’s permissions.
Work continuing in the background preserves its identity and delegation history. New accesses and actions are subject to current checks, including after permission changes or credential revocation.
Access Protection and Monitoring
Looplex protects communications between components and manages the secrets used by services. Relevant authentication, authorization, and execution events are logged for monitoring and investigation.
Signs of misuse may result in access restrictions, credential revocation, or suspended operations. Zero Trust combines these controls with network protection, segmentation, and device security.
Available Settings
The organization configures groups, roles, permissions on collections and resources, and integration access. Depending on the product and deployment, it can use federated authentication, additional authentication requirements, network restrictions, and conditional access policies.
Device compliance assessment depends on integration with the identity and device management mechanisms used by the organization. Its scope is defined during deployment, taking available technical capabilities into account.
Customer Responsibilities
The customer keeps accounts and groups up to date, removes access that is no longer needed, and reviews permissions granted to integrations and accounts under its administration.
It also protects its team’s devices and credentials, defines who may delegate work, and establishes authority for approving actions. Enabling a connector must take into account the resources it exposes and the permissions actually granted in the connected system.
Standard controls, specific settings, and the division of responsibilities follow the contracted product and the Corporate Security Measures Notice.