AI Governance
Permission-aware retrieval, topic guardrails, audit trails, and automatic PII redaction — governance enforced on every AI screen in TotalApp, not bolted on afterward.
Overview
AI Governance is the layer that sits between every AI feature in TotalApp — assistants, Semantic Search, writer tools, dashboards — and the data those features can see. Instead of trusting each screen to enforce access control on its own, every AI call is filtered through your existing RBAC and tenant boundaries at query time, so the model only ever retrieves records the requesting user is already allowed to see.
The goal is that adopting AI inside TotalApp never requires loosening your permission model. A sales rep asking an assistant about revenue and HR salary bands in the same prompt gets an answer built only from the records their role grants — the rest is filtered out before it ever reaches the model, not redacted after the fact.
Where to configure it
Governance is on by default and inherits your existing role and tenant setup — there is no separate policy language to write for basic access control. Topic guardrails and redaction rules are refined from the AI Governance screen. See Agentic AI Settings for the broader Agentic configuration and Embedding Model for how retrieval ranking interacts with permission filtering.
Permission-Aware Retrieval
Every AI answer is filtered through your existing role-based access control and tenant boundaries at query time — no flattened access, no cross-department leaks, no shortcuts around your role model.
- Vector and document retrieval scoped to the requesting user's role and capabilities.
- Department- and tenant-level information silos enforced automatically, the same way they are elsewhere in TotalApp.
- Permission changes apply instantly — no re-indexing, no stale access left over from a previous role.
- Unauthorized retrieval attempts are blocked outright, not silently degraded into a vague answer.
Because filtering happens before retrieval rather than after generation, a blocked record is never seen by the model in the first place — there's nothing for the AI to accidentally paraphrase or leak.
Topic & Content Guardrails
Prohibited topics can be scoped per tenant — competitor mentions, legal or medical advice, off-policy discounts, anything a given assistant shouldn't discuss. Every attempt to cross the line is declined and logged rather than silently allowed.
- Per-tenant topic and content policies enforced on every AI screen, not just chat assistants.
- Business-only enforcement — off-topic and out-of-scope prompts are declined with a clear reason.
- Policy violation attempts are logged with the user, the prompt, and a timestamp.
- Guardrails are configurable per role, so an externally-facing assistant can run stricter limits than an internal one.
Audit Trail & PII Redaction
Every AI screen logs its activity 24/7 — who asked, what was retrieved, what was blocked or redacted — so nothing about AI usage in your tenant is a black box.
Full audit log
Every call records the user, the prompt, the source data touched, and the policy decision made — exportable as CSV for compliance review.
Automatic PII redaction
Sensitive fields — SSNs, salaries, personal identifiers — are anonymized before a prompt ever reaches the model, not scrubbed from the response afterward.
Source attribution
Every AI answer links back to the records it was built from, so a reviewer can verify a claim against its source in one click.
Secure File Analysis
Files uploaded into an AI conversation are inspected before they're processed, the same way a security-conscious file server would screen an upload — reducing the risk of an unvetted document silently entering a prompt and reaching the model as shadow-AI input.
Hybrid knowledge scope
Depending on the assistant, retrieval can be scoped to your tenant's own records only, or to a hybrid mode that blends your data with general knowledge — useful when a question needs both internal context and broader background, without ever letting general knowledge substitute for a governed answer.
Governance, Built Into Every Layer
Access control, guardrails, audit, and redaction are enforced automatically across every AI screen in TotalApp — the same rules apply whether the request comes from a chat assistant, a dashboard insight, or a writer tool.
| Control | What it enforces |
|---|---|
| Permission-Aware Retrieval | RBAC and tenant boundaries applied at query time, before any data reaches the model. |
| Topic & Content Guardrails | Per-tenant prohibited topics declined and logged, configurable per role. |
| Full Audit Trail | User, prompt, source data, and decision logged for every AI call, exportable for review. |
| Automatic PII Redaction | Sensitive fields anonymized before a prompt reaches the model. |
| Secure File Analysis | Uploaded files screened before AI processing to reduce shadow-AI risk. |
| Source Attribution | Every answer links back to the records it was built from. |
| Tenant-Level Isolation | Governance policies, logs, and access rules never cross tenant boundaries. |
| Compliance-Ready Exports | Audit logs export as CSV aligned with internal policy and regulatory review. |
How a Request Flows
A record that fails the permission check never reaches the model — it's excluded at retrieval, before generation starts. That's why the audit log can say exactly what was filtered out and why, rather than only what the model was told not to repeat.