Skip to main content
Surfaice is designed so that access never expands beyond what a user already has in connected systems of record. Hugo is the AI agent inside Surfaice. When this page mentions Lucernex, that is an example lease-administration platform — your company may use Lucernex or another system of record. New to Surfaice? Start with What is Surfaice?.

​
Inheritance

When a user asks Hugo to look something up in Lucernex, SharePoint, email, or another connected system, Surfaice acts with that user’s existing entitlements. If the user could not open a file or record outside Surfaice, they should not see it through Surfaice.

​
What Hugo can access (by connector)

Permissions are always evaluated at request time under the signed-in user’s account. Your workspace may enable only a subset of these connectors.

​
Role gates inside Surfaice

Separately from source-system ACLs, Surfaice roles control:
  • Who is invited to the workspace
  • Which connectors a role may use at all
  • Which skills are offered
Example: property management may connect email; other roles never see that connector option even if the tenant consented to the application.

​
Email specifics

  • Mailbox connections are user-granted to that user’s mailbox
  • There is no tenant-wide mailbox read
  • Instance-wide exclusion lists (keywords, senders, domains, folders) can block sensitive topics across skills

​
Revocation

Revoking access in your identity provider or disconnecting a connector stops access. Because Surfaice does not mirror your systems of record, there is nothing to “unwind” in Lucernex or SharePoint. Deletion of the limited data that does persist in Surfaice is handled under your customer agreement.

​
Data flow (high level)

Hugo assembles context at run time. Authoritative records remain in your systems of record until your team deliberately saves or exports an accepted artifact.