Security boundaries for Seren Employees

Control boundary

Do not treat model instructions as authorization

A system prompt guides model behavior, but it is not a security boundary. Untrusted messages and content can try to change that behavior.

The employee runtime exposes only permitted tools. Seren services authorize each protected operation outside the model.

Identity and least privilege

Give each employee its own limited identity

A managed cloud employee uses a stable agent identity. Do not place a personal API key in employee instructions, files, or configuration.

Grant access to the employee that needs it. Prefer read access when the job does not require changes. Revoke unused grants.

Organization authority

Require every authority layer

Organization collaboration requires a current policy, employee assignment, and service grant. A failure at any layer stops the protected operation.

A signed work context binds the authorized run boundary. It does not replace current resource authorization.

Seren does not continue failed organization work as individual work. This rule prevents a denied request from crossing into a weaker context.

Approvals

Bind approval to the proposed action

When an action requires approval, Seren pauses before the protected change. The approval applies only to the displayed action and its arguments.

The employee must request a new approval if an argument changes. A declined or unanswered request makes no change.

Channels and external identity

Treat a channel as an entry point, not an authority source

A Slack or other channel identity does not replace a Seren member identity. A channel connection also does not grant organization capabilities or define an output audience.

Channel-scoped organization collaboration is not enabled yet. Core rejects a channel origin instead of issuing a signed work context. A future channel path must check a current managed binding at issuance and revalidation.

Secrets and connectors

Keep credentials out of prompts

Seren Passwords and approved connectors hold account credentials. The employee receives a scoped tool interface instead of the secret value.

Connector access does not create organization authority. Organization policy, employee assignment, connector grants, and approval policy remain separate controls.

Direct connector tools are unavailable during an organization run. The current connector path cannot revalidate the signed work context or bind an approval to each action. This restriction prevents a connector action from bypassing collaboration authority.

Execution isolation

Separate trusted and untrusted work

The trusted employee runtime controls service credentials and tool policy. Sandboxed skill processes do not receive those credentials.

Browser-enabled employees use a managed browser session. Sandboxed skill code does not receive the browser endpoint or open access to the runtime network.

Data protection

Keep organization content inside its boundary

Organization product data uses isolated organization service storage. Operational platform records do not contain plaintext conversations, tool arguments, or connector identifiers.

Memory, Storage, Passwords, and skill databases apply their own isolation and grant rules. Encryption adds protection but never replaces authorization.

Revocation and audit

Apply changes at protected operation boundaries

Services check current grants before protected operations. Revocation blocks the next operation even when an active run has a signed work context.

Immutable revisions, approval records, run events, and organization audit entries support investigation and controlled rollback.

Compliance

SOC 2 Trust Services Criteria and security reviews

SerenAI builds and operates its security program to the SOC 2 Trust Services Criteria, with controls covering access control, encryption, logging, incident response, change management, and the managed platform.

For security questionnaires, the current subprocessor list, the Data Processing Agreement, or evidence requests, contact the SerenAI team.