Encryption and keys

Choose an appropriate policy

Data protection distinguishes transport, storage and key control. Models can declare requirements; enforcement depends on effective capabilities and authorized configuration. A lock icon does not replace those checks.

Concept	Expected value	Meaning
Transport	Protected channel	Protection during exchange
Storage	Encryption of relevant resources	Protection of retained data
CMK / BYOK	Authorized key and integration	Service-specific key control
Rotation	Explicit policy	Key and access evolution
Revocation	Operation with documented effects	Withdrawal of cryptographic access

Understand AI processing

Encryption at rest and control of a key do not mean an AI provider never processes plaintext content. Operations needing content must be reviewed with their profile, provider and permissions. Do not confuse CMK or BYOK with a general promise of end-to-end encryption.

Example

An organization protects Clients data with its key policy and restricts AI profiles allowed for quotes. Revoked or unavailable keys require an explanatory diagnostic; the system does not bypass policy through unprotected storage.

See permissions, residency and protection contracts in the Model reference.

Applied examples : Protect data while retaining useful context

Permissions control the operation and the policy bounds disclosed sources. Manage keys in Surface security settings.

Configuration

Fragment placed in contentActions[]. Properties and accepted values.

{
  "contract": "ContentSpaceActionPolicy@1",
  "spaceKey": "clients",
  "actionKey": "archive-client",
  "minimumRole": "owner"
}

Variation and connection

Fragment placed in contextPolicies[]. Properties and accepted values.

{
  "key": "quote-knowledge",
  "targetDefinitionPaths": [
    "workspace/quotes/surface/quote"
  ],
  "sources": [
    {
      "key": "pricing",
      "kind": "knowledge",
      "definitionPaths": [
        "workspace/knowledge/surface/pricing"
      ],
      "linkTypePaths": [],
      "queryKey": null,
      "required": true,
      "revision": "current",
      "priority": 1,
      "maximumItems": 3,
      "maximumCharacters": 12000
    }
  ],
  "maximumCharacters": 16000
}

UI layout example

The illustrative layout below places this configuration in the Clients/Quotes app. Insert each fragment at the stated location, with Field, Query and Action references matching the Model declarations.

1. Action
2. Minimum role
3. Authorized sources
4. Decision

SurfaceClients / North StudioExample

Encryption and keysProtect data while retaining useful context

Clients

Prepare a quoteeditorSubject to access

Archive clientownerConfirmation required

Space permissions combine with the application role and account policy.