The browser never chooses what knowledge it is allowed to search.

One OpenAI vector store per organization, with the ID stored in a browser-denied Firestore location.

Firebase ID tokens are exchanged for secure HTTP-only session cookies and verified on protected routes.

Permissions are checked in the interface, APIs, Firestore rules, and Storage rules.

Employee questions enable only File Search. Unsupported requests are not guessed.

Provider file IDs must match search results, annotations, server mappings, document access, and organization ownership.

Questions, answers, citations, usage, feedback, and manager review status are retained in Firestore.

Firebase App Check is wired into the web client. Storage and Firestore enforcement is enabled by operators after monitoring valid production traffic.