Workspace · Permissions

Governance that’s obvious and unobtrusive

For Admins, Project Leads, and Compliance teams running workloads. Mirror roles, gate high-risk actions, and log every LLM answer and export, without slowing legal or finance work.

RBAC mirroring Step-up approvals Lineage & LLM audit Residency aware LLM observability (LLMO)

Workspace scope

Global policies, residency, and AI/LLM integrations

Project control

Per-team permissions and approvals for projects

Source gates

Mirror drive/DB access for the assistant — no broad copies

Attested outputs

Exports with approver trails and model context

Role mapping overview — Teams

Sync legal, finance and risk teams into projects with mirrored roles and groups.

Approval swimlanes — Obligations

Add step-up approvals when AI actions, exports or data unlocks need an extra review.

Audit trail visualization — Keep track of progress

See end-to-end lineage for LLM usage from prompt to source to attested export.

Where permissions apply

Clear scopes for AI assistants, projects, threads, and sources.

Workspace

Policies, residency, and default roles
Integration scopes and API keys for models and tools
Global export, attestation, and logging rules

01 Least-privilege by default

No broad ingestion. Access mirrors your existing systems and roles.

02 Approvals with context

Approver, scope, timestamps, and rationale recorded for sensitive actions.

03 Attested outputs

Briefs & exports carry signatures, model info, and policy snapshots.

What changes with Xybern

Cleaner controls, faster approvals, safer exports.

Before

Broad data copies to shared drives for “experiments”
Manual approvals in email and chat threads
No audit trail for prompts, answers, or exports

After

Mirrored, read-scoped access with retrieval logging
Step-up approvals for high-risk AI actions and exports
Attested, cited outputs with full lineage

Global Asset Manager

−48% approval time

From 2d → same day for AI workspaces with step-up flows

Banking Compliance

0 PII leak incidents

90 days post go-live on LLM projects

Legal Ops

+3x review throughput

Cited, governance-ready briefs and exports

Who can do what?

Filter by action or role. Hover labels for definitions.

Action	Owner	Admin	Editor	Viewer
Create project	Allow	Allow	—	—
Invite member	Allow	Allow	—	—
Run tools / LLM reasoning	Allow	Allow	Allow	—
Attach sources	Allow	Allow	Allow	—
Approve redlines / exports	Allow	Allow	Request	—
Export briefs	Allow	Allow	Allow	Read-only
Set residency	Allow	Allow	Request	—

Allow = Full access • Request = Needs approver • Read-only = View/export only • “—” = Not permitted

Trust & controls built in

Mirror roles, gate sensitive actions, and trace every export — with LLMO-ready logs.

RBAC Mirroring

Bring your existing roles and groups. Least-privilege by default with per-project scopes for workloads.

Step-Up Approvals

Gate exports, source unlocks, and LLM-driven redlines with approver, rationale, and timestamps.

Lineage & Audit

Source → action → output logged end-to-end. Click through any claim to its evidence and prompts.

Residency & Retention

Enforce EU/UK residency and policy-based retention windows across projects, threads, and exports.

See permissions live on your AI data

Run a guided evaluation on your own legal and finance workloads. Measure approval time saved, audit completeness, and governance with a sample attested export.

Request Enterprise Pilot