Console
Wiki

schema/access-policy.md

schema/access-policy.md

Business Brain Access Policy

Effective: 2026-08-28

This policy governs access to the LoboDesk Business Brain. It supplements agent-protocol.md. If the two conflict, access must fail closed and the founder must resolve the conflict.

Security boundary

Each business and customer has a separate vault. A task scoped to one vault must not search, read, summarize, index, cite, or modify another vault.

LoboDesk vault:

/home/hermes/.hermes/vaults/lobodesk

Access to one business never implies access to another business or customer.

Authorization source

The AI Employee Registry and the prepared employee execution context are the authoritative authorization sources.

An employee may access this vault only when all conditions are true:

  1. The employee is active.
  2. Employee execution is enabled.
  3. Global execution is enabled.
  4. can_execute is true.
  5. The task is assigned to the employee.
  6. Workspace access explicitly includes this vault or an approved subdirectory.
  7. The requested operation is allowed by the employee policy.

Filesystem visibility alone does not grant authorization.

Roles

Founder

The founder may:

  • Read all LoboDesk vault zones.
  • Add or correct source material.
  • Approve, reject, archive, or delete memories.
  • Mark wiki pages reviewed or stable.
  • Change schema and access policy.
  • Approve access for employees.
  • Resolve contradictions.
  • Approve cross-business operations.

AI employees

AI employees receive no Business Brain access by default.

When explicitly authorized, an employee may perform only the operations and access only the paths included in its prepared execution context.

Employees may never:

  • Expand their own vault permissions.
  • Modify their own registry or approval policy.
  • Access another business or customer vault.
  • Treat filesystem access as authorization.
  • Store credentials, tokens, private keys, or secret values.
  • Push Git changes or publish externally without approval.
  • Delete memories.
  • Mark their own work reviewed or stable.

Customer-facing agents

Customer-facing agents may access only the customer-specific vault assigned to that customer.

They must never mount or query:

  • The global founder vault.
  • The LoboDesk internal vault.
  • Another customer's vault.
  • Another business's vault.

Zone permissions

Sources

Source body content is immutable after creation.

During an explicitly assigned ingestion task, an authorized agent may update only:

  • status
  • updated

Allowed lifecycle:

unread -> reading -> processed

Corrections to source title, author, URL, tags, or body require founder action.

Wiki

Authorized agents may create and update draft pages.

Pages marked reviewed or stable require explicit founder instruction before modification.

AI employees cannot approve their own draft memories.

Journal

Journal content is founder-owned and read-only to employees.

The daily workflow may create a new scaffold, after which the journal entry becomes founder-owned.

Schema

Schema is founder-owned and read-only to employees unless a specific founder-approved task authorizes an exact schema change.

Memory lifecycle

  1. A source is added by the founder or through an approved task.
  2. The source starts as unread.
  3. An authorized employee changes its status to reading.
  4. The employee creates or updates draft wiki memories with citations.
  5. Contradictions are recorded and left unresolved.
  6. The employee changes source status to processed.
  7. The founder reviews the draft memory.
  8. The founder may mark it reviewed or stable.
  9. The full-text index is refreshed.
  10. Archived material remains retrievable unless the founder authorizes deletion.

Corrections and contradictions

Agents must not silently replace conflicting facts.

Conflicts must be recorded in wiki/contradictions.md, including the competing claims and their sources. Only the founder resolves the authoritative interpretation.

Sensitive information

The vault must not contain:

  • Passwords
  • API keys
  • Access tokens
  • Private keys
  • Authentication cookies
  • Raw environment values
  • Unredacted credentials
  • Payment-card or banking credentials

A source containing necessary confidential information must remain outside the Business Brain. The vault may store only a sanitized reference stating where authorized personnel can find it.

Indexing and retrieval

Indexing must operate on one explicit vault path.

The indexer must not discover or combine sibling business or customer vaults automatically.

Full-text search is the default retrieval mechanism. Embeddings require separate founder approval, secure credential injection, cost limits, and business-isolation testing.

Audit and approval

Every employee memory task must retain:

  • Business ID
  • Employee ID
  • Employee run ID
  • Child-session ID, when delegated
  • Authorized paths and modes
  • Files created or modified
  • Validation result
  • Final status

Production publication, external messaging, external spending, schema changes, and cross-business access require founder approval.

Failure behavior

Missing, ambiguous, or conflicting authorization must fail closed.

A failed ingestion or indexing operation must preserve the last-known-good database and source files. It must not publish a partially generated cross-business index.