Each person accesses only the authorized context.

Skip to content CONECTA ENGINE · 03/03 Each person accesses only authorized context.

The Conecta Engine preserves permissions provided by the source. Workspace policy adds limits without expanding source access, and each person, engine, agent or action receives separate authorization.

Follow the narrative Full view of the Conecta Engine CONECTA ENGINE DIAGRAM LAYER SALESPERSON MANAGER FINANCE Source The source’s original permission is the first limit when reliable. ALLOWED ALLOWED ALLOWED Workspace The workspace adds a limit when the source lacks granularity. RESTRICTED RESTRICTED RESTRICTED Consumers Viewing, using, executing and approving are different permissions. ALLOWED ALLOWED ALLOWED Effective rule The most restrictive rule accompanies the result. EFFECTIVE EFFECTIVE EFFECTIVE

Access follows the data from the source to the response, the derived metric and any subsequent use.

01 Data and documents Gather data, files and records. 02 Operational context Organize each data point in the business map. 03 Permissions and trust Make access follow the data. ADD RESTRICTIONS FOR TEAMS AND INDIVIDUALS EXAMPLE DATA

illustrative example of policies per person.

Operational matrix: EXAMPLE DATA SCOPE MODEL CONNECTORS CONTEXT BUDGET / MONTH

Marina · Growth

JUST Claude

200K R$ 1.2 thousand +8%

Felipe · Management

ALL EXCEPT Claude

1M R$ 2.4 thousand +5%

Camila · Finance

ONLY OpenAI

64K R$ 800 -4%

Rafael · Operations

JUST Gemini

128K R$ 900 +3% Adoption only comes with governance

SOCEO is the governance layer that unlocks AI adoption in the company. Launch agents on day 0 with cost, connector and context controls per team and person.

Who each policy applies to Entire teams Individuals Specific exceptions What it limits for each agent Permitted models Context size Connector access Monthly budget 90% maximum context savings 100% agentic adoption 6 months for full adoption 01 · SOURCE Original source permission is the first limit when reliable.

When the source exposes sufficient permission details, access by person, group, role, document, record, or field is preserved in the context.

Inheritance is declared only when the source supplies the rule. Revocation and scope changes must remain traceable. Without sufficient granularity, access stays blocked. 01 SOURCE PERMISSION 01 · SOURCE 02 · EXPLICIT FALLBACK The workspace adds a limit when the source does not offer granularity.

When the source lacks sufficient control, workspace policy adds an explicit scope without expanding or replacing any available original permission.

Source and workspace remain distinct layers. Policy starts with the least access necessary. An exception needs a visible source and justification. 02 SOURCE LIMIT WORKSPACE POLICY EFFECTIVE ACCESS 02 · EXPLICIT FALLBACK 03 · ROLE-BASED SCOPES Salesperson, manager and Finance receive different scopes.

The salesperson consults their own portfolio, the manager tracks the team, and Finance accesses costs and margin within the authorized scope.

Each connector page states the available support. Different people consult only their own context scope. The explanation gives the reason for the restriction without revealing the content. 03 SALESPERSON MANAGER FINANCE PORTFOLIO TEAM COSTS 03 · ROLE-BASED SCOPES 04 · DERIVED CONTEXT The most restrictive rule follows the result.

Effective access follows the most restrictive rule between the original permission of the source, the workspace policy and the context consumer: person, engine, agent or action.

The combination preserves the lowest access level. Protected fields remain protected in the calculation. The metric keeps partial coverage visible. 04 SOURCE RULE WORKSPACE RULE ROLE RULE COMBINES LIMITS MOST RESTRICTIVE RULE 04 · DERIVED CONTEXT 05 · AUTHORIZED USE Viewing, using, executing and approving are different permissions.

People, sources, workspace, engines, agents and actions participate in layered access that should not be confused.

Reading authorizes only access to released content. Use by Planeja or Controla requires separate authorization. Writing by Age or an agent requires another authorization. 05 PERSON ENGINE AGENT ACTION VIEW USE EXECUTE APPROVE 05 · AUTHORIZED USE 06 · VISIBLE LIMIT When the Conecta Engine blocks access, it explains why.

The user can see whether the restriction comes from the source, workspace, object, field, role, or a pending revocation.

The explanation identifies the layer responsible for the limit. The interface does not reveal protected content to justify the block. Source, transformation, delay, conflict and gap accompany what was authorized. 06 AUTHORIZED RESPONSE PROTECTED EXCERPT OMITTED EXCERPT ROLE LIMIT NO ACCESS 06 · VISIBLE LIMIT SAME SOURCES, DIFFERENT ACCESS The response changes according to the authorized scope.

Three scopes use the same set of sources and show only the context allowed for the salesperson, manager and Finance.

01

The salesperson consults their own client portfolio.

02

The manager tracks the team's authorized scope.

03

Finance accesses costs and margin when permitted.

04

Every denial identifies the layer that restricted access.

SOURCES WITHIN THE SAME BOUNDARY Each source offers its own access granularity.

The catalog organizes sources with different access limits and keeps visible the relationship between origin, workspace and authorized use.

Public catalog. Each connector page states its status and limits.

IDENTITY, COLLABORATION AND RECORDS GD Google Drive SP SharePoint MT Microsoft Teams NO Notion SL Slack SF Salesforce HS HubSpot DS DocuSign M3 Microsoft 365 DATA, TOOLS AND CONTROLLED ACTIONS OD OneDrive PB Power BI SU Supabase VE Vercel WP WordPress CA Canva CU ClickUp IO incident.io MI Miro NEXT STEP Data, context and access form the authorized base consulted by other engines.

Go back to the full view of the Conecta Engine or check the limits of each item in the public catalogue.

Back to Conecta Engine View connector catalog