01
"Where do we say anything about this?"
Semantic search across everything the caller is allowed to see, with each passage cited to the exact file it came from. A passage with no citation is a defect worth reporting.
Four zones, and the only interesting question is which of them you own.
One {server}, no model, and a mirror that only runs one way.
The gateway is a stateless server in a cloud account you own, fed by a one-way copy of the document libraries you approve, and reached by your people through the assistant they already use. Nothing in it reasons. Every part of it is there so that a question finds the right passage, cites the file it came from, and stops at the edge of what the asker may see.
What sits where.
TOPOLOGY · FOUR ZONES
Two of the four zones are outside your cloud account and two are inside it. That split is the product's honest map: your people, their assistant, your identity provider and your document libraries all live where they already live, and everything the gateway builds lives in an account you hold the root credentials for.
The endpoint is a public one, protected by authentication and a small firewall rule set. There is no private network path, so the control is the sign-in rather than the network, and we describe it that way.
Outside your account
Inside the account you own
The control point
org{•}tech / gateway / zone-topologyYour people · your account · your assistant's vendor
Outside your account
Your peopleIn the assistant they already use
Assistant vendorThe model runs here. The connector executes here
Your identity providerYour existing multi-factor and conditional access rules
Your document librariesStill the front door for filing
Inside · identity
Managed directoryFederated to your corporate sign-in
Hosted sign-in pageThe server never sees a password
Role writerRoles written into the token at every mint
Inside · the gateway One container
Tool gate and scope checkEvery call, server-side, narrow only
Protocol endpointAuthenticated HTTPS on your own domain
Web application firewallA small, explicit rule set
Inside · the feeding layer
Mirror workerOne per approved library, on a schedule
Parser and embeddingsText out, vectors in
Index and tablesPassages, confirmed facts, canonical tables
Secret storeThe read-only source credential, nowhere else
Solid zones are the account you own. Green is outside it. The hot node is the only place an access decision is made: a call that fails the gate never reaches retrieval.
A copy that runs one way and stops when you say so.
THE MIRROR · ONE WAY
Read-only · one library at a time
Your libraries stay the system of record.
The gateway never writes back to the source. It holds the tightest read-only permission your document platform offers, granted against one named library and refused for every other library in the same tenancy, and you can revoke it in one action without involving us.
- 01Only what changed. Change tracking pulls the delta since the last clean run, and the bookmark advances only after a run completes cleanly. A half-finished run does not quietly become the new baseline.
- 02Your folder tree, preserved. A file's address in the mirror is its path in the library, which is what makes scoping by folder and citing by file meaningful.
- 03Deletions propagate. Remove a file from the library and it goes from the mirror on the next run, so the mirror does not quietly outlive the source.
- 04Moves and renames do not. They arrive as new content. It is a known behaviour of the change feed, not a surprise.
- 05Raw exports welcome. Structured exports can be dropped into a folder exactly as they came out of the system that produced them. Nobody reformats anything by hand.
mirror · scheduled run
CLEAN
sync library "Operations" --since-bookmark
[auth] read-only grant · 1 library · revocable by you
Changed since last run312 files
Parsed and embedded✓ 298
Unsupported format△ 14 listed, not guessed
Deleted at source✓ 3 removed from mirror
Renamed at source2 arrive as new content
Write back to library✕ no such path exists
bookmark advanced · run was clean
Illustrative outputone library
A run that is not clean·leaves the bookmark where it was
On freshness, precisely
Approved sources are checked on a short schedule. That is a cadence, not a freshness guarantee. End-to-end freshness has not been measured, so there is no figure to publish and none to plan around. In the one real build, about 96% of a corpus of several thousand documents became searchable; the remainder was almost entirely unsupported formats, which are listed rather than silently skipped.
Your corporate sign-in, and no new password.
SIGN-IN · ABOUT TWO MINUTES
Sign-in at a glanceGATEWAY-AUTH
- ProtocolOAuth 2.1 authorization code with PKCEThe vendor's connector never holds a long-lived secret of yours
- IdentityYour corporate sign-inFederated by OpenID Connect to a directory in your account
- Your existing rulesApply unchangedMulti-factor and conditional access are your identity provider's, not ours
- RolesWritten into the token at mintDerived from the verified email address, server-side
- The server checksIssuer, signature, expiryIt never talks to your identity provider and never sees a password
- Unknown personGets nothingThere is no default role
Six steps · nothing to distribute
A person connects once, and then forgets it exists.
Adding the gateway is the same gesture as adding any other connector in your assistant. The person pastes one address, is sent to a sign-in page, signs in to the corporate account they use all day, and comes back connected. It takes about two minutes, and there is no secret for an administrator to hand out and later rotate.
- 01Nothing to install. No new application, no per-seat software, no desktop agent. The assistant is the client.
- 02Roles are asserted, not asked for. What a person reaches is decided by policy on the server from their verified identity, not by anything they type or the assistant sends.
- 03Offboarding happens where you already do it. Remove someone from your corporate directory and they stop signing in to the gateway too. There is no separate gateway password to revoke and no second user list to remember.
What your people actually ask.
TOOLS · AS QUESTIONS
The server exposes tools and nothing else: no prompts, no resource listings, no instruction string of ours riding along in your assistant's context. They are grouped in families, and the set changes as a client's process changes. What is durable is the family, so here they are written as the question a person asks out loud.
02
"Open that one and read me pages four to nine."
Full extracted text of a file or a page range, across word processing, spreadsheet, presentation including speaker notes and chart data, portable documents and plain text. File type is detected from content, not from the extension.
03
"What do we actually know, and who said so?"
Read a record's facts, each marked confirmed, candidate or missing, and each sourced to the cell it came from. Propose what needs sign-off. Record a person's decision against their verified identity.
04
"Do it our way, not the model's way."
Your own written methods, served verbatim as skills, so a drafting task follows your sequence rather than the assistant's instincts. The book, in the room, every time.
05
"Draft the thing, but only from signed-off facts."
The server returns a scaffold whose slots are filled from confirmed facts with citations, or flagged as gaps. Your assistant writes the prose. Outward-facing modes accept confirmed facts only, enforced in code rather than in a prompt.
06
"What did that add up to?"
Profile the raw exports, build canonical tables, run integrity checks first, then answer a governed set of questions in SQL over every row. Every answer carries how it was computed and how to reproduce it.
07
"What changed in the library this week?"
Start a refresh, or ask for the per-library checkpoint state. Sync is a thing your people can see rather than a background process they have to trust.
08
"Is this one ready to go out?"
Capability packs encode one organization's process on the same kernel: readiness checklists, stage tracking with entry criteria, ask lists, standard workbooks, roll-ups. A pack adds no second source of truth.
Nobody types a tool name. People ask in plain language and the assistant picks the tool, which is why the guidance that shapes good behaviour lives in long, exact tool descriptions.
Tens of dollars a month, and nothing per seat.
RUNNING COST · YOUR BILL
The economics are unusual because the expensive part is somewhere else. Your assistant subscription already pays for the model, and the model is not in this account's request path at all. What remains is storage, a small always-on container, a vector index and some scheduled work, so cost tracks document churn rather than how much your people use it. Compute and storage are billed by your cloud provider directly to you, at their list price. We never sit between you and that bill.
| What runs | Where it runs | What drives its cost |
|---|---|---|
| The protocol endpoint | One stateless container in your account, on your own domain | Always on, small. Requests are cheap because no model is called. |
| The mirror workers | Your account, one per approved library, on a schedule | How often your documents change. |
| Parsing and embedding | Managed services in your account | Mostly a one-time cost at first index, then delta only. Quoted in writing before anything is indexed. |
| The vector index | Your account | Corpus size. This is the line that is usually assumed to be expensive and is not. |
| Confirmed facts and canonical tables | Your account | Negligible. Structured rows, not documents. |
| The answering model | ✕Your assistant's vendor | Your existing assistant subscription. Nothing new, and nothing from us. |
Figures: the one real build has run at tens of dollars a month on the client's own cloud bill. That is what we have seen in one deployment, not a quote, and your corpus decides most of it.
01If it runs in our account, do we have to operate it?
Somebody does, and by default it is us. "Runs in your account" never means "requires no operations": there is a pinned version to keep, a mirror and an index to keep healthy, access changes to make, connectors to maintain when a vendor changes something, and incidents to answer. That is managed operations, and it starts the day your people connect rather than some months later.
02Can the gateway change anything in our document libraries?
No. There is no write-back path to the source system, by design and not by configuration. Derived writes change product-managed state only: a confirmed fact, a canonical table, a generated artifact, a workflow stage, each attributed to a person. The separation is set out on access and the data boundary.
03Which document platforms does it connect to?
One commercial document platform is proven in the one real build, one library at a time, through a read-only grant. Other sources are adapter work rather than new architecture, and they are scoped in the assessment. Raw structured exports need no connector at all: they are dropped into a folder as received.
04Does it work with any assistant?
We have evidence with two major assistant vendors. We do not say "works with any client", because conformance across the protocol's implementations varies and we have not tested the others. If yours is a third, that is a conformance test in the assessment, not an assumption in a proposal.
⎯⎯ Book the strategic assessment ⎯⎯
Your files, inside your control ·
A bounded piece of work that inventories your sources, classifies the risk, names the roles and tells you what an indexed corpus would cost to build and to run.