Your team and your agents only see what you allow.
Set the rules once. They apply to every person, every agent, every model - the same boundary everywhere. An AI agent with unrestricted access is as risky as an employee with unrestricted access.
| Team / agent | Client files | Payroll | Case notes | Strategy |
|---|---|---|---|---|
| Partners | ✓ | ✓ | ✓ | ✓ |
| Associates | ✓ | ✗ | ✓ | ✗ |
| Agent - Research | ✓ | ✗ | ✗ | ✗ |
| Agent - Drafting | ✓ | ✗ | ✓ | ✗ |
| Contractors | ✗ | ✗ | ✗ | ✗ |
Same governance model for humans and AI agents.
Most AI platforms treat agent access as an afterthought. The agent can see whatever the user who created it can see. That's not governance - that's a gap.
IIMAGINE applies one access model, everywhere. The account owner defines who (or what) can see which data. Those rules hold whether the accessor is a person logged into the platform, an agent running a multi-step task, or an external API call.
The boundary doesn't live in a settings page you forget about. It's the constraint the entire platform runs inside.
What's governed.
Workspace isolation
All data is scoped to workspaces. Personal workspaces are private. Team workspaces share data only with members. No cross-workspace leakage.
Agent data scope
Each agent operates within the boundaries you set. A research agent can read client files but not payroll. A drafting agent can read case notes but not strategy docs.
Tool approvals
Per-tool approval settings. Read actions run freely. Write actions (send email, update spreadsheet, create event) require your explicit sign-off.
Connection permissions
OAuth connections are workspace-level. You decide which platforms are connected and which agents can use them. Revoking a connection cuts access instantly.
Credential encryption
All third-party tokens encrypted at rest (AES-256-GCM). Never exposed to client-side code. Decrypted only at the moment of API call, server-side.
Role-based access
Workspace roles (owner, admin, member) control who can create agents, manage connections, invite team members, and configure billing.
What this looks like for a real team.
An accounting practice with 3 partners, 5 associates, 2 AI agents, and 1 contractor:
- Partners see everything - client files, payroll, case notes, strategy documents
- Associates see client files and case notes but not payroll or strategy
- Research agent reads client files to pull registration data - cannot see case notes, payroll, or strategy
- Drafting agent reads client files and case notes to draft letters - cannot see payroll or strategy
- Contractors see nothing until explicitly granted access to specific projects
The research agent cannot accidentally include payroll data in a client report. The drafting agent cannot reference a strategy doc in a client letter. The boundary holds at every step.
The risk most people don't think about.
When you give an AI agent access to "your data" - what does that actually mean? In most platforms, it means everything. Every file, every email, every spreadsheet the account has access to.
Now imagine that agent runs a task that produces a client-facing document. What stops it from including internal financial data, HR notes, or strategy documents in the output? In most platforms: nothing.
Data governance isn't about locking things down. It's about making sure the right information reaches the right place - and nothing else leaks.
- Client-facing agents should never see internal financials
- Drafting agents should never reference documents the recipient isn't meant to see
- Research agents should only access the data categories they need
- Contractors should see only the project they're working on
- Former team members lose access immediately on removal
When the data cannot leave the building at all.
For conversations and tasks that are too sensitive for any server - regardless of access rules - run models locally on your own machine. Zero network traffic. Same interface, same agents, same governance model.
Three privacy tiers:
- Cloud (standard) - data processed on IIMAGINE servers with your access rules enforced
- Regional cloud - use your organisation's approved cloud (Azure, AWS, GCP) to access GPT, Claude, Gemini within your compliance boundary
- Local - open-source models running on your machine. Zero bytes sent externally.
AI without boundaries is AI without control.
Free account. No credit card. Set your governance rules in minutes.
Start free