An answer you cannot audit is an answer a regulated institution cannot use. This page describes what is enforced, how, and what is not there yet.
Tenant separation is enforced by row-level security in Postgres, not by application filtering. A query that loses its tenant context returns nothing rather than everything.
An adversarial suite attempts cross-tenant reads, writes, deletes, searches, exports, agent access and session revocation. A test that infers safety from unchanged state proves nothing, so each one carries out the forbidden operation.
Content you may not see is never fetched — not fetched and then filtered out. Nothing a model is asked to ignore was ever placed in front of it.
An agent does not inherit the privileges of whoever started it. A Guardian run by an administrator still cannot read an unrelated portfolio or approve anything.
Material non-public information cannot cross into a public-markets workflow. That is a securities question, not only a privacy one, and it is enforced as a gate rather than a policy document.
Arithmetic, permissions, entitlements, hashes and the immutable record are code. A model that restated a number would produce a figure nobody could defend.
Sessions are server-side records, so revoking one works immediately. Membership is re-checked in the database on every request — removing someone ends their access on the next request, not at next login.
Nothing you tell LyraMind improves what another customer sees. Relevance learning is tenant-local by construction.
No automated process can change what your institution believes. Every material state change passes through a human, and the record names the agent that proposed it and the person who accepted it.