> For the complete documentation index, see [llms.txt](https://docs.lleverage.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.lleverage.ai/administer-and-govern/security-and-assurance.md).

# Security and assurance

Review Lleverage as an operational system: data access, credentials, architecture and the evidence buyers or IT teams need.

Security review should follow the real operational path: which data Lleverage can reach, which systems it can act in, which credentials make that possible and who can change that authority.

This is broader than the Control menu. Control tells you how the product is configured. Security and assurance helps IT owners, process owners and buyers decide whether that configured operation is acceptable.

## Start with the actual use case

For each production capability, establish:

* which business process and Projects are in scope;
* what information enters Lleverage;
* which external systems are read or changed;
* which identities, Connections or credentials provide that authority;
* which people can operate, build, publish or administer it;
* where deliberate human decisions remain;
* what execution evidence is available for operational review;
* what formal assurance your organisation requires before rollout.

The useful boundary includes Lleverage, connected systems, identity, model providers, organisational policy and the specific automation being deployed.

## Identity and directory access

For Enterprise customers using group-managed access, [Directory access security notes](/administer-and-govern/control/members/directory-access/security-notes.md) document the current Entra ID and SCIM permissions, stored directory data, sync failure behaviour, disconnect semantics and audit retention. Directory access must currently be enabled by Lleverage for the organisation.

## Product guidance and formal evidence are different

These docs explain current product behaviour and recommended operating boundaries. They are not a substitute for a current security report, certification, legal agreement, data-processing terms or customer-specific architecture review.

Use Architecture and assurance review to structure that review and the Technical & support reference for lower-level lookup material.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.lleverage.ai/administer-and-govern/security-and-assurance.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.