Skip to main content

Security & compliance

CortexHub gives security and compliance teams a single control plane for AI-assisted tool use. Assistants never hold long-lived vendor credentials in chat; admins control Org Agents, members connect personal credentials in CortexHub Cloud, and every tool call runs through policy and audit. The same controls apply whether the AI runs as a hosted Org Agent, an external client (Claude, Cursor, ChatGPT, a partner runtime), or a CortexHub Co-worker.

What you control​

ControlWhere it livesOutcome
Who can connectOrganization membership and rolesOnly invited users sign in
Which integrations existOrganization toolkit catalogueAdmins enable vendors deliberately
Who can use a toolkitGovernance groupsLeast-privilege by team or function
Which tools runGroup entitlements and policiesFine-grained allow lists
High-risk actionsApproval policiesHuman-in-the-loop before a tool runs
Re-authenticationStep-up policiesA fresh sign-in before sensitive actions
Data handlingData-handling guardrailsSensitive values scrubbed from stored records
EvidenceActivity and tool-call logsTamper-evident traceability for reviews and incidents

Layered policy​

Policy is layered and tightening only. Three tiers stack, widest at the top, and each tier can only narrow the one above it, never widen it:

  1. Organization floor: the org-wide minimum, set by admins in plain language and applied to every call.
  2. Group: per-group rules on the toolkits and tools a team may reach.
  3. Member: each member may tighten the rules on their own connected toolkits and their personal files, but can never loosen what the org or their group already requires.

A member can make their own access stricter; they can never weaken the organization's oversight or approval requirements.

Authentication model​

  • Interactive AI clients (Claude, Cursor, ChatGPT, and similar) use browser OAuth. Users approve the app name shown on the consent screen, and each client registers as its own identity.
  • Programmatic agents use one of two credentials: a programmatic Member Credential (the member bound to the OAuth client is the CortexHub identity) or an organisation gateway key (one org-scoped, rotatable secret where each call attests the end user it acts for). Either way, secrets stay in your runtime, not in prompts.
  • Vendor credentials are stored per member connection in CortexHub Cloud, scoped to the member and toolkit, injected at call time, and never returned to the agent or chat.

Vendor credentials are never pasted into AI chats. The org gateway key is the only org-scoped key surface; there is no per-user or shared API key for individual vendors on the gateway.

Policy before a tool runs​

01

Connect

OAuth sign-in from your app or SDK session.

02

Search

Agent finds tools via cortexhub_search_tools.

03

Policy

Group rules run before any downstream call.

04

Invoke

Permitted calls reach Slack, Jira, and others.

05

Audit

Spans and receipts recorded in CortexHub Cloud.

Tool discovery and execution go through CortexHub meta-tools (cortexhub_search_tools, cortexhub_get_tool_schemas, cortexhub_invoke_tools, cortexhub_get_task, cortexhub_request_consent). Every call resolves to one base decision, permit, require approval, or deny, plus any obligations such as a re-authentication step. Calls parked for approval or consent complete server-side once a person decides; the agent polls an MCP Task. Common outcomes are ok, awaiting_user_consent, awaiting_operator_approval, autonomous_consent_required, step_up, and policy_denied. Each attempt, including a parked one, produces a tamper-evident audit record linked to the original attempt.

Redaction is for stored records​

Data-handling guardrails scrub sensitive values from what CortexHub stores (audit records, traces, logs); they do not silently alter the call the agent makes. The agent receives the full call and the full response. Any control that must stop or change an action belongs on the approval or deny decision, not on redaction.

Co-worker oversight and privacy​

Each entitled member gets one hosted Co-worker, governed by the same policies, approvals, and audit as external agents. An org admin or owner has read-only oversight of any member's agents: identity and status, activity, tool calls, governance decisions, approvals, and usage. Genuinely private member surfaces, chat transcripts, the Co-worker's Brain, and personal file contents, are never visible to admin oversight.

Questions for vendor review​

Use these when completing a security questionnaire or security review:

  1. Credential access: Confirm which integrations your organization enables and who can connect them.
  2. Logging: Who can view tool-call and approval history in your organization?
  3. Offboarding: Remove organization membership and revoke the user's MCP credentials when they leave.
  4. AI client sprawl: Each MCP app registers as its own identity, so you can reason about Claude Desktop vs Cursor separately.

Recommended rollout​

  1. Pilot with one organization and a small governance group.
  2. Enable only the toolkits required for the pilot.
  3. Configure approval policies for write or destructive actions.
  4. Review activity logs weekly during the pilot.
  5. Expand groups and integrations after sign-off.

See also​