Security, restrictions and your data

The AI works inside sapio365 or your EZ Suite product, with the rights you have there, and you decide how far it goes. This page lists what the AI can reach, the restrictions you can set, how its actions are traced, and where your data goes.

What the AI can reach

• The AI acts only through the product, with what is already signed in: your sapio365 session, or your Notes ID. It never receives your credentials. In sapio365 it never calls Microsoft Graph itself: your session, role, RBAC restrictions and elevation apply exactly as when you work by hand. In the EZ Suite, the access of your Notes ID applies.

• Each product's MCP server listens on a localhost address, for AI clients on the same computer, and refuses requests sent from web pages in a browser.

• A server is available only while its product is open and the server is started. Stop server, in the product's AI Settings panel, cuts every AI client off from that product at once.

Restrict what the AI can do

Set these restrictions in the <product> MCP part of the AI Settings panel. Each product keeps its own settings.

• When the AI meets a restriction, the product tells it why, and the AI tells you that the action is up to you, in the product itself.

• In the EZ Suite, Forbid reading data with AI covers grid content. The tools that describe where you stand keep answering: your Notes session, the open database or server, effective access, and in scanEZ the database properties, the tree (including the titles of checked notes) and the Info tab of the focused note.

Restrictions imposed by a role (sapio365)

A sapio365 administrator can impose each of the three restrictions through sapio365 role delegation (RBAC), with the admin scopes Cannot save data with AI, Cannot read data with AI and Cannot load sessions with AI. The role of every open session counts: the session of the main window and the session of each open module. A restriction imposed by a role applies in every session and tenant: in the AI Settings panel, its box is ticked and locked, and its tooltip says that only an administrator can change it.

Once no open session has a role that imposes it, the box is unlocked but stays ticked: the restriction stays on until you clear the box.

Actions that need your go-ahead (EZ Suite)

In the EZ Suite, every tool that changes something requires the AI to state that you asked for it, and switching Record activity off or replacing an ACL also requires your explicit confirmation. See The EZ Suite MCP servers.

When sapio365 is locked

While sapio365 is locked, for example until you unlock a password-protected job at startup, its MCP server answers no AI request: nothing is done and nothing is read. The AI tells you that unlocking sapio365 is up to you.

What the AI did is traced

• In every product, a run started by AI is marked AI - in the automation console.

• In sapio365, the User Activity Logs show, for every job and automation script the AI runs and the actions they perform, the name of the AI client in the AI Client column, with an AI icon.

• When a job or an automation script fails, the AI can read the end of the product's trace to explain why.

Your data

• What the AI reads through the product (session details, grid content, selected rows, job and view XML, database and ACL details, trace lines) becomes part of your conversation and is sent to the AI provider behind your client, like anything you type. Trace lines can hold user names, e-mail addresses or license details. Make sure your AI client and provider are approved by your organization for the data you work on.

• Ask only for what you need: the AI can read selected columns and rows rather than a whole grid.

• To keep grid content out of the conversation, tick Forbid reading data with AI.

• The Ytria documentation server has no connection to your products, your tenant or your Domino environment: it sees only what the AI sends it, such as a search or a job to validate.