What is Riley's security model for memory, permissions, approvals, and proof?

Riley's security model comes down to a simple promise: it gets the least access it needs, it cannot act outside your workspace without your approval, and everything it does is recorded. Your memory and your data stay yours to read, edit, export, or delete.

Some parts of the model are fully live today, and a few are partly built. This post says which is which, because a security page that rounds everything up to done is not one you should trust.

Riley asks for the narrowest access that gets a job done. If a workflow only needs to read, that is all it gets. Each connection is scoped to what you grant when you connect it, and Riley cannot reach past those scopes.

Every integration works in one of three modes: read only, drafts for your approval, or writes that always pass through approval first. You can disconnect an integration or revoke an access key from Settings at any time, and it stops working immediately.

Any action that changes something outside your workspace waits in your approvals queue. You see what will happen before it happens, and that gate holds no matter which surface the request came from. A connected AI client cannot skip it.

Your workspace is isolated. Your data, connections, and keys are scoped to your workspace, and requests are pinned to the signed-in workspace on every call. Connection credentials stay in the connection layer, and sensitive fields are kept out of logs, so the AI works with results rather than your raw secrets.

What Riley remembers about your business, including your brand voice and preferences, is yours to read and edit from the dashboard. Your data is not used to train models behind your back, and any cross-customer learning is opt-in and off by default. You can export your workspace data or delete your account from Settings, where deletion uses a grace period and then removes your data.

Completed actions land in the outcome ledger as they happen, and security-relevant events are recorded separately. That record is written at the time of the action, not pieced together later, and it is what feeds the signed receipts you can verify.

A few pieces are real but not finished, and it would be dishonest to call them done. Key rotation is manual today: you can mint a new key and revoke the old one whenever you want, but scheduled automatic rotation is not built yet. Role-based access for teams exists but is not yet surfaced across every page, so treat per-role boundaries as partial for now.

A full per-surface breakdown of AI usage is also only partly built. Today you can see the work, wherever it came from, but a complete per-surface usage report is still rolling out. We would rather tell you that than let a page imply more than the product does.