Permissions
How Surfaice inherits existing access, gates connectors by role, and never expands entitlements.
Surfaice is designed so that access never expands beyond what a user already has in connected systems of record.
Hugo is the AI agent inside Surfaice. When this page mentions Lucernex, that is an example lease-administration platform — your company may use Lucernex or another system of record. New to Surfaice? Start with What is Surfaice?.
Inheritance
When a user asks Hugo to look something up in Lucernex, SharePoint, email, or another connected system, Surfaice acts with that user's existing entitlements. If the user could not open a file or record outside Surfaice, they should not see it through Surfaice.
What Hugo can access (by connector)
Permissions are always evaluated at request time under the signed-in user's account.
| Connector | Hugo can typically… | Hugo cannot… |
|---|---|---|
| Lucernex | Read facilities, contracts, and fields your Lucernex role allows | Write to Lucernex without an explicit save workflow you approve |
| SharePoint | List and read sites, libraries, and files you can open in the browser | Crawl the entire tenant or sites IT has not consented to |
| Outlook / email | Search and read your mailbox (and drafts you send) | Read other users' mailboxes or bypass exclusion lists |
| Google Drive | Read files and folders shared to your account | Access files you have not been granted |
| ServiceChannel / CMMS | Read work orders and locations under your vendor or operator role | Dispatch vendors or close tickets without your action |
Your workspace may enable only a subset of these connectors.
Role gates inside Surfaice
Separately from source-system ACLs, Surfaice roles control:
- Who is invited to the workspace
- Which connectors a role may use at all
- Which skills are offered
Example: property management may connect email; other roles never see that connector option even if the tenant consented to the application.
Email specifics
- Mailbox connections are user-granted to that user's mailbox
- There is no tenant-wide mailbox read
- Instance-wide exclusion lists (keywords, senders, domains, folders) can block sensitive topics across skills
Revocation
Revoking access in your identity provider or disconnecting a connector stops access. Because Surfaice does not mirror your systems of record, there is nothing to "unwind" in Lucernex or SharePoint. Deletion of the limited data that does persist in Surfaice is handled under your customer agreement.
Data flow (high level)
flowchart LR
User[User in browser] --> Hugo[Hugo agent]
Hugo --> Surfaice[Surfaice workspace]
Surfaice --> Lucernex[Lucernex]
Surfaice --> SharePoint[SharePoint]
Surfaice --> Email[Mailbox OAuth]
Surfaice --> Audit[Audit log]
Hugo --> Artifact[Draft artifact / Preview]
Artifact --> User
Hugo assembles context at run time. Authoritative records remain in your systems of record until your team deliberately saves or exports an accepted artifact.