Compliance
Who did what, what they were allowed to do, and where the data went
| Policy | Applies to | Rule | State |
|---|---|---|---|
| Data stays in region | all agents | Models and storage in the EU only; US models blocked | enforced |
| No admin rights | all agents | Agents may change user settings, never roles or groups | enforced |
| Personal data | Identity, HR | Health and salary fields masked before any model call | enforced |
| Money | Procurement | Orders over $500 need a named approver | enforced |
| Outside email | all agents | No messages leave the company domain | enforced |
| Retention | audit log | 7 years, immutable, exportable | enforced |
Last 30 days
No policy violations. Three blocked attempts, all outside email, each logged with its ticket.