AI & Technology
Governance and Security
How Connected Spaces governs AI Agents — ephemeral architecture, six pillars, human approval gates, and a way to stop an agent — designed to reduce the attack surface.
AI Agents that can reach your business information deserve more than a checkbox in a settings screen. This page explains how Connected Spaces governs its AI Agents — what limits their authority, what requires your approval, what logs every action, and how an agent is stopped.
The honest framing: our architecture is designed to reduce the attack surface. That is different from claiming something is secure. We describe what the design does. You decide whether it meets your bar.
The Contractor Model
The easiest way to understand AI governance here is to think about how you already manage contractors.
A contractor has a contract. It defines what they can do, what they cannot do, who they report to, and how you end the engagement. You wouldn't hand a contractor the keys to your building without that contract. Your digital contractors — the AI Agents working inside your connected foundation — work the same way.
- Agent contract — the explicit scope definition: which tools the agent can call, which data it can access, and what it is not allowed to do under any circumstances.
- Authority boundary — the line between what the agent can do without asking (draft, collect, organize, summarize) and what requires your approval first (send, delete, commit funds, publish).
- Reporting line — the human in the middle who reviews consequential actions before they execute.
- Termination clause — a way to stop the agent (part of setup guardrails), runs that end at a fixed step and time limit, and approval requests that expire if nobody acts.
This is not a metaphor layered on top of the product. It is how the product is architected.
The Nest Protocol
Connected Spaces AI Agents are ephemeral — designed to reduce the attack surface by eliminating the most common attack target: a persistent process with standing access.
Most AI agents run as always-on processes. They exist between sessions. They hold credentials. They are a target at rest.
CNX Agents are not.
- Born for the task, destroyed after. Each agent is spun up per-request and torn down when the task is done. There is nothing to reach between sessions.
- Server-side only. Agent code runs exclusively on the server. The
"use server"directive is not a preference — it is enforced. Agent logic never executes in the browser. - Identity rebuilt per request. Context is rebuilt from the authenticated session on every action. The agent never trusts the client.
- Scoped permissions. Each agent can only call the tools it has been explicitly granted. No tool access beyond scope is possible — not through a workaround, not through another agent.
- Encrypted communications. Every credential is encrypted with its own key. AES-256-GCM with a per-document initialization vector. No shared secrets.
- Memory isolation. What one agent knows, another cannot access. There is no shared memory between agents. No cross-contamination.
The safest agent is the one that doesn't exist when it's not needed.
Six Governance Pillars
These six pillars are not a feature list. They are the architectural commitments that make AI Agents trustworthy enough to act in your real business — with real costs, real vendors, and real customers.
1. Accountability
Every action is attributed to a named agent with a defined scope. There are no anonymous actions. When something happens, the record shows which agent did it, what it was authorized to do, and what it actually did.
In plain terms: You know who did what. Always.
2. Agent Identity
Each agent operates under a dedicated non-human identity — not a shared API key, not a generic system account. Each co-worker has its own identity. No shared passwords.
Why it matters: Shared credentials mean a compromised key can act as any agent. Dedicated identities mean a scoped identity can only act within that agent's contract.
3. Prompt Injection Defense
Agent instructions live server side. Server-side policies and scoped permissions constrain permitted actions. These controls do not establish immunity from prompt injection.
In plain terms: Your agents run on instructions set on the server. What they do cannot be overridden from the outside.
4. Auditability
Every agent action is logged in a reviewable audit trail. Timestamped. Reviewable. Exportable. When a regulator, an auditor, or a curious owner asks "who did what and when," the answer is already recorded.
In plain terms: Something happened? You have the record. Every action. Every agent. Every time.
5. Data Privacy and Permissions
Agents access only the data they are explicitly granted. No cross-agent data sharing. No memory that persists beyond the session. What one agent is shown, another agent cannot retrieve.
In plain terms: Agents only touch what they need. Nothing more.
6. Human Override
Three mechanisms, set up as part of your guardrails:
- Stop control — a person you authorize can stop an agent.
- Bounded runs — every run has a step and time limit we set, so an agent cannot keep going on its own.
- Expiring authority — an approval request expires after a few minutes if nobody acts on it. Where we switch on Automated Mode for a low-risk routine task, it runs for a fixed window and switches itself off.
In plain terms: A person can stop the agent.
Human-in-the-Loop Approval
AI Agents in Connected Spaces draft, collect, organize, and analyze. They do not act unilaterally on consequential decisions.
When an agent reaches an action that is destructive, financial, or irreversible — sending an email to a supplier, committing budget, publishing a campaign — it stops and surfaces a confirmation request. You see exactly what it intends to do and why. You approve or reject. Then it acts (or doesn't).
This is not a friction point added to slow things down. It is the line between scoped autonomy and autonomous AI — and Connected Spaces is firmly on the scoped side.
What requires approval before executing:
- Sending communications on behalf of the business
- Deleting or archiving records
- Committing or modifying budget figures
- Publishing to external channels
- Awarding bids or contracts
What agents do without approval (within their contract):
- Drafting content for your review
- Collecting and summarizing data
- Monitoring metrics and flagging anomalies
- Organizing information and generating reports
- Preparing recommendations
The phrase order is intentional throughout: expert humans + AI Agents. Humans first. Always.
What We Don't Claim
A few things we will not say about our security posture, because they would not be accurate:
- We do not claim to be unhackable or 100% secure. Nothing is.
- We do not claim "enterprise-grade security" — that phrase means nothing verifiable.
- We do not claim our architecture is "secure by design." Design choices reduce the attack surface. That is what we claim: reduced attack surface, not a security state.
What we do claim is concrete and verifiable: ephemeral execution, server-side only, scoped permissions, encrypted credentials, dedicated agent identities, human approval gates, a way to stop an agent, reviewable audit trail. Each of those is a specific architectural decision, not a marketing adjective.
Infrastructure Foundation
We run your agents on the leading AI models — OpenAI, Anthropic and Google today — through one integration layer, so the model can change without the rules changing. Agent-to-tool communication can use Model Context Protocol (MCP), the open standard. If a tool has an API, an MCP server or a dashboard, we can connect it, and the connection runs under the same rules as everything else: Square, Toast, QuickBooks and HubSpot are typical.* We confirm the scope of each link first.
* Some tools take longer and need a workaround. Tool names belong to their owners; naming one means we can work with it, not that they endorse or certify us. More on what we connect.
We deploy on Vercel. Where the safety architecture calls for it, we use NVIDIA NemoClaw, an open-source reference stack for policy-based safety guardrails.
We are not a partner, reseller or certified affiliate of any AI provider. Under the business terms we use with every AI provider, your data is not used to train their models. Stricter data-residency or isolation options are available where regulation requires.
Related Topics
- How AI Agents connect to tools (MCP) — MCP, how we connect your tools, and how custom links are scoped
- From message to execution — the full journey from your instruction to a completed action
- Agent delegation and @-mentions — how handoffs work and where the human approval boundary sits