Integration Permissions and Administrator Controls
Technical disclosure. Use your browser’s print command to save this complete version as PDF.
This matrix describes the QCM assurance release dated 19 October 2026 and the recorded production feature configuration. It identifies each integration’s accessible data, trigger and available disable authority. Provider-side copies and already-dispatched work are separate from stopping future operations.
1 AI and transactional email
| Integration | Data and actions | Control and limitation |
|---|---|---|
| Managed OpenAI inference | Relevant contract text, questions, drafting inputs and selected context are sent for the requested operation; results return to QCM. The adapter does not grant the provider a general workspace browsing credential. | An owner or administrator can select AI off in workspace AI settings. The server blocks provider credential resolution and rechecks policy immediately before each dispatch, retry and managed fallback. Existing records remain accessible. A request already sent to a provider cannot be recalled. |
| Customer AI credentials | Where available, an owner or admin can add, verify and remove a provider key and select the provider/model. Stored keys are not returned by the status API. | BYOK depends on the credential vault being configured. Deleting the selected BYOK provider sets the workspace AI policy to disabled before removing the credential; it does not silently switch recipients to managed AI. Vault availability remains environment-specific. |
| Managed fallback | A failing BYOK credential may use managed AI only under the configured fallback policy. | Fallback defaults to false and is explicitly configured by an owner/admin. It is refused if AI is disabled or the provider policy changed before dispatch. Turning managed AI back on requires an explicit policy change. |
| Resend email | QCM submits recipient details and template content for transactional delivery. It may include verification or invitation links and contract-related metadata. | No per-workspace administrator switch for the entire email service was established. An operator can change service configuration, but doing so affects login recovery, invitations and signing notifications. |
Credential governance
Only workspace owners and administrators may mutate AI provider policy or credentials. Changes are audited. AI off blocks new inference calls, including queued work reaching the dispatch boundary and retries; it does not recall completed or in-flight calls. Customer keys never appear in provider-status responses. Require a verified policy setting before provisioning a workspace whose contract excludes external AI processing.
2 Optional product and public data flows
| Flow | Scope | Enable and disable |
|---|---|---|
| QCM to Qedara Graph | Approved billing intent: entity and partner identifiers, contract/version references, approved line items, amounts, tax/currency details, payment rules and document evidence references from the approved snapshot. | Delivery flag was not set in production. Operator-controlled server configuration and authorisation checks are required. No customer-facing universal connector-disable control was established. |
| Qedara Start authorisation | A separately enabled authorisation point validates the permitted Start entity and credentials for the approved flow. It is not unrestricted access to the workspace. | Production authorisation flag was not set. Operator configuration controls activation. Recipient entity, infrastructure and complete downstream data handling must be documented before enabling. |
| Company intelligence and due diligence | Queries use partner identifiers and authorised dossier information. Source calls and downloaded public lists vary by jurisdiction and feature. AI assessment can create an additional inference flow. | Server feature flags were enabled; workspace entitlement, policy and action permissions still gate use. Admin monitoring/policy controls are not proof of a global block on every lookup. |
| Customer exports and signing recipients | An authorised user can export selected records or invite designated signatories. This intentionally discloses selected data outside the workspace. | Membership and action checks apply. Removing an invitation or user does not recall an already downloaded file; the receiving organisation controls its copy. |
3 Review before activation
For each new integration, record the legal recipient, countries, exact fields and files sent, inbound permissions, trigger, credentials, approval authority, disable method and effect on existing copies. Validate disabled behaviour server-side, queued work and retries as well as the UI. Revocation must prevent new processing and separately address data already delivered.
The original public documents remain applicable. This matrix supplies the missing permission detail; it does not claim controls absent from the reviewed implementation. A provider or integration change also triggers the subprocessor and transfer assessment where relevant.