01 / REVIEW CYCLE
Define the boundary
Identify the agent, the topic and the permitted disclosure level. IT and the relevant business owner agree what the task actually needs.
ThinkPort / Governance
A clear boundary.
A record to
stand behind.
Let teams put AI to work with permissions you control and evidence you can review. Every answer makes the boundary visible: what was shared, what stayed inside and why.
01The smallest permitted answer
02A signed record of the boundary
03Transparency for company and people
Disclosure / not all-or-nothing
A fact, a summary or a clause. You decide.
Set disclosure levels per agent and per topic. Sensitive health, legal and finance information stays restricted unless you explicitly permit access.
POLICY EXAMPLE / SUPPLIER AGREEMENTIllustrative / not a live policy editor
Permission to share a clause is not permission to share the whole file. A refusal releases no contract information.
Agent asks
“What can you tell me about the supplier agreement?”
Released / Fact
The notice period is 60 days.
- Applied boundary
- Fact only
- Raw file sent
- None
- Withheld
- Value · names · full file
Company policy and personal policy. The stricter one wins. An employee's personal permissions cannot be overridden by a looser company rule, and personal sharing cannot bypass company restrictions.
Receipt anatomy
The answer is small. The evidence isn't.
The receipt is the record of the interaction, including the information that never reached the agent. Review the permission behind an answer, not just the output.
Signed records can be exported and verified independently. Verification establishes the integrity of a record; it does not, by itself, prove that an underlying document was correct or that a legal obligation has been met.
Interaction receiptEXAMPLE / 004218
- Agent
- Claude / sales assistant
- Requester
- Account manager / sales role
- Question
- When does the supplier agreement renew?
- Disclosed
- Renewal date and notice period
- Withheld
- Price, signatories and full contract
- Authority
- Company → sales → requester
- Policy
- sales.renewals.fact-only / v14
- Raw file sent
- None
Signed record / illustrative values, not live company activity
Human oversight
A rule is a decision. Keep its history.
Good governance connects the person who sets a boundary with the people who review its effects. Policies, usage and evidence belong in the same conversation.
02 / REVIEW CYCLE
Review the outcome
Follow a permitted answer or a refusal through its receipt. Check the disclosed context, the withheld information and the permission that applied.
03 / REVIEW CYCLE
Make changes accountable
When a rule changes, retain who changed it and when. Review access and disclosure as teams, sources and AI tools evolve.
A refusal is also an outcome
If a topic is restricted, the agent receives no information from it. The refusal belongs in the evidence trail, so reviewers can distinguish a deliberate boundary from a missing answer.
Usage, not employee scoring
Review agent activity, disclosure decisions and processing costs. ThinkPort is not designed to evaluate or rank people, and personal information stays subject to its own permissions.
Evidence pack
Ready for the people who ask questions.
Bring dated records together for an auditor, a regulator or a works council. A clear evidence trail supports your review; it doesn't replace a legal assessment.
AI register
Agents, models, purposes and the assessments your reviewers need.
Policy history
Who changed a rule, when and under whose permission.
Interaction receipts
Disclosures and refusals, with signed records for verification.
Worker transparency
Notices, acknowledgements and AI-literacy records.
Data map
Sources, categories, processing locations and retention information.
Rights requests
Receipts for access, export and erasure actions.
Transparency goes both ways.
People can see queries that concern them. Company usage oversight is not employee scoring: ThinkPort is not designed to evaluate or rank a person. Keep personal information protected while making the use of AI accountable.
Explore deployment and security controlsA closer look
Good questions.
Clear answers.
Does an Evidence Pack make us compliant?
No. It brings together records that support an assessment: policy history, agent information, source maps and signed interaction evidence. Your legal obligations and risk classification still need an appropriate review.
Who should review the receipts?
The administrators and reviewers your company authorises. Different teams may need different access to evidence. Receipts themselves can contain sensitive information and should be governed accordingly.
Can a personal policy be overruled by company policy?
A more permissive company rule does not override a stricter personal permission. The same works in the other direction: personal sharing cannot bypass a company restriction.
What does independent verification establish?
It lets a reviewer check the signed record rather than simply trusting a screenshot of activity. Record integrity and the accuracy or legal sufficiency of the underlying information are separate questions.
Your company / your terms
See the answer. Inspect the boundary.
Bring your governance questions. We'll walk through permissions, receipts and the evidence your reviewers need.