Organization boundaries
Session membership, role permissions, and PostgreSQL row-level security scope access to customer resources.
Authority stays outside the conversation.
A prompt cannot grant permissions. Organization access and tool authorization belong to the server.
Controlled actions
Protected tools require customer verification. Anything that changes data is read back and runs only after the caller says yes. High-risk actions are disabled.
Honest assurance
Zyvra does not currently hold third-party certifications such as SOC 2 or ISO 27001, and makes no regulatory-compliance claims. Accounts support multi-factor authentication, and production workspaces require it before changes.