The common failure is to hand a model the tenant database and filter the output afterwards. BuildWithHQ resolves the user's permitted record set first, then assembles retrieval context from that set only. The model is never in a position to leak what it was never given.
The order of operations is the whole design. Permissions are resolved on the transactional side, and the resulting set is passed to the vector search as a filter — so retrieval physically cannot reach outside it.
The permitted record set is computed before retrieval runs, not applied to the results afterwards.
A record can be readable by a person and still excluded from AI retrieval. Those are two different flags.
Encrypted values have no searchable form, so they never enter embeddings without anything special being configured.
Each retrieval logs the envelope it was permitted to draw from, which is what makes it auditable later.
Observations generated from records, inheriting their permissions from the source record. An insight drawn from something you cannot see never reaches you.
The assistant proposes a next step with a pre-filled payload. Nothing executes without a person accepting it, and acceptance rates are tracked so suggestions improve.
Conversations scoped to a record or module, answering from the data in context rather than from the model's imagination.
An agent that acts on one person's behalf, within that person's permissions, with a daily execution quota enforced server-side and an approval queue in front of anything consequential.
An industry-specific AI configuration — a harness pack, in the product — is everything that sits around the model for one industry: instructions, tone, vocabulary, worked examples, permitted actions, guardrails, and compliance language.
Packs layer. A platform base pack sets the ground rules, an industry pack refines them, a builder pack adapts them to your product, and a tenant pack handles one customer's terminology. Each layer overrides only what it needs to.
A pack can carry an evaluation set marked as a publish gate. When it does, a new version cannot be published until a passing evaluation run exists for that exact version. This is deliberately stricter than running evaluations and looking at the score: a pack that fails its own tests does not ship.
Harness packs configure how the assistant behaves. Nothing in a pack can widen a permission envelope. The security boundary is enforced below this layer, and no payload written into a pack can reach it.
Retrieval draws on your data to answer your users' questions within their permissions. Your business data is not used to train shared models.
Yes, and it is a distinct permission. A record can be readable by a person and excluded from AI retrieval at the same time, and encrypted fields are excluded automatically.
Consequential actions go to an approval queue rather than executing directly, agents operate strictly inside the permissions of the person they act for, and a daily execution quota is enforced on the server.
Create an account, explore the full builder console, and launch your first application on a custom domain. Nothing is charged while your application is still in development.
No credit card required. The console preview, the documentation, and the architecture reference are all readable before you sign up.
Get started free Read the docs