> For the complete documentation index, see [llms.txt](https://docs.lleverage.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.lleverage.ai/administer-and-govern/security-and-assurance.md).

# Security and assurance

Review Lleverage as an operational system: data access, credentials, architecture and the evidence buyers or IT teams need.

Security review should follow the real operational path: which data Lleverage can reach, which systems it can act in, which credentials make that possible and who can change that authority.

This is broader than the Control menu. Control tells you how the product is configured. Security and assurance helps IT owners, process owners and buyers decide whether that configured operation is acceptable.

## Start with the actual use case

For each production capability, establish:

* which business process and Projects are in scope;
* what information enters Lleverage;
* which external systems are read or changed;
* which identities, Connections or credentials provide that authority;
* which people can operate, build, publish or administer it;
* where deliberate human decisions remain;
* what execution evidence is available for operational review;
* what formal assurance your organisation requires before rollout.

The useful boundary includes Lleverage, connected systems, identity, model providers, organisational policy and the specific automation being deployed.

## Identity and directory access

For Enterprise customers using group-managed access, [Directory access security notes](/administer-and-govern/control/members/directory-access/security-notes.md) document the current Entra ID and SCIM permissions, stored directory data, sync failure behaviour, disconnect semantics and audit retention. Directory access must currently be enabled by Lleverage for the organisation.

## Product guidance and formal evidence are different

These docs explain current product behaviour and recommended operating boundaries. They are not a substitute for a current security report, certification, legal agreement, data-processing terms or customer-specific architecture review.

Use Architecture and assurance review to structure that review and the Technical & support reference for lower-level lookup material.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.lleverage.ai/administer-and-govern/security-and-assurance.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.