> ## Documentation Index
> Fetch the complete documentation index at: https://docs.surfaice.pro/llms.txt
> Use this file to discover all available pages before exploring further.

# Permissions

> How Surfaice inherits existing access, gates connectors by role, and never expands entitlements.

Surfaice is designed so that **access never expands beyond what a user already has** in connected systems of record.

**Hugo** is the AI agent inside Surfaice. When this page mentions **Lucernex**, that is an example lease-administration platform — your company may use Lucernex or another system of record. New to Surfaice? Start with [What is Surfaice?](/concepts/what-is-surfaice).

## Inheritance

When a user asks Hugo to look something up in Lucernex, SharePoint, email, or another connected system, Surfaice acts with that user's existing entitlements. If the user could not open a file or record outside Surfaice, they should not see it through Surfaice.

## What Hugo can access (by connector)

Permissions are always evaluated **at request time** under the signed-in user's account.

| Connector                 | Hugo can typically…                                                   | Hugo cannot…                                                    |
| ------------------------- | --------------------------------------------------------------------- | --------------------------------------------------------------- |
| **Lucernex**              | Read facilities, contracts, and fields your Lucernex role allows      | Write to Lucernex without an explicit save workflow you approve |
| **SharePoint**            | List and read sites, libraries, and files you can open in the browser | Crawl the entire tenant or sites IT has not consented to        |
| **Outlook / email**       | Search and read **your** mailbox (and drafts you send)                | Read other users' mailboxes or bypass exclusion lists           |
| **Google Drive**          | Read files and folders shared to your account                         | Access files you have not been granted                          |
| **ServiceChannel / CMMS** | Read work orders and locations under your vendor or operator role     | Dispatch vendors or close tickets without your action           |

Your workspace may enable only a subset of these connectors.

## Role gates inside Surfaice

Separately from source-system ACLs, Surfaice roles control:

* Who is invited to the workspace
* Which connectors a role may use at all
* Which skills are offered

Example: property management may connect email; other roles never see that connector option even if the tenant consented to the application.

## Email specifics

* Mailbox connections are user-granted to that user's mailbox
* There is no tenant-wide mailbox read
* Instance-wide exclusion lists (keywords, senders, domains, folders) can block sensitive topics across skills

## Revocation

Revoking access in your identity provider or disconnecting a connector stops access. Because Surfaice does not mirror your systems of record, there is nothing to "unwind" in Lucernex or SharePoint. Deletion of the limited data that does persist in Surfaice is handled under your customer agreement.

## Data flow (high level)

```mermaid theme={"theme":{"light":"github-light","dark":"github-dark"}}
flowchart LR
  User[User in browser] --> Hugo[Hugo agent]
  Hugo --> Surfaice[Surfaice workspace]
  Surfaice --> Lucernex[Lucernex]
  Surfaice --> SharePoint[SharePoint]
  Surfaice --> Email[Mailbox OAuth]
  Surfaice --> Audit[Audit log]
  Hugo --> Artifact[Draft artifact / Preview]
  Artifact --> User
```

Hugo assembles context at run time. Authoritative records remain in your systems of record until your team deliberately saves or exports an accepted artifact.

## Related

* [Connectors](/guides/connectors)
* [Data handling](/concepts/data-handling)
* [Audit trail](/concepts/audit-trail)
* [Trust FAQ](/concepts/trust-faq)
* [Security overview](/security)