Role-based access
Access is role-based; an agent never exceeds the permissions of the user who runs it. What you cannot see, the agent cannot see either.
SECURITY & GOVERNANCE
Autonomy you control.
Bibliyor can act autonomously — but never invisibly.
AUTONOMY LEVELS
Four levels. You draw the line.
-
01
Reads
Reads, scans and summarizes connected sources. It changes nothing in your external systems.
-
02
Prepares
Prepares the draft, the report, the plan — the output lands in front of you. Not a single write has touched an external system yet.
-
03
Gets approval
Sets the action up but never presses the button. The critical step waits until you approve; nothing changes in any external system before that.
-
04
Autonomous
Runs end to end inside the boundaries you define. Every step passes a permission check; every run leaves an audit trail.
Autonomy is a setting, not an on-off switch: you set it per mission, per system.
Six mechanisms that keep you in control
Audit trail
Who ran what, and when — every run is recorded. The audit trail is not written after the fact; it forms as the run does.
Evidence graph
"Which document did this decision come from?" Every answer is linked to its sources: document, clause, record. One step takes you from result to source.
Data boundaries
You define what agents can reach: which store, which folder, which table. Outside the boundary, nothing exists for the agent.
Human-approved critical steps
Steps that change the outside world sit behind the approval layer. Your organization decides which steps require sign-off.
On-premise option
For enterprises whose data must never leave their own infrastructure, an on-premise deployment is available — data stays inside your perimeter.
MODEL SAFETY
The guardrail layer
Governance is more than permissions and audit trails: everything that goes to a model — and everything that comes back — passes through a guardrail layer that runs on the platform today.
PROMPT INJECTION DEFENSE
Instructions embedded in documents and external content are detected and neutralized — the agent only runs the mission you gave it.
RESTRICTED TOPIC FILTERS
Topic and content policies you define are enforced on both requests and responses; out-of-policy content is stopped before it reaches a model.
PERSONAL DATA MASKING
Names, IDs and similar entities are masked before they are sent to a model; when the answer returns, masks are mapped back to the originals. The model never sees personal data.
KVKK and data processing
Data processing roles and procedures are defined in the data processing terms (DPA) attached to the enterprise agreement: which data, for what purpose, for how long, by whom. Your data is not used to train AI models; that commitment is stated explicitly in the agreement.
Our KVKK notices are in the publication process. In enterprise deployments we work through the process with your compliance team: data inventory, access boundaries and retention terms are clarified together in the scoping work after the demo.
Every answer has a source. Every action leaves a trail.
You keep control. Bibliyor does the rest.
Know. Think. Act.