> For the complete documentation index, see [llms.txt](https://surecloud.gitbook.io/surecloud-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://surecloud.gitbook.io/surecloud-docs/documentation/gracie/governance-and-controls.md).

# Governance & Controls

Understand the controls that govern Gracie, including approvals, permissions, logging, and credit usage.

## Governance & Controls

Gracie is designed to work within the same control model as the rest of SureCloud.

Tenant admins can control who uses Gracie, what she can do, and how AI activity is monitored across the tenant.

{% hint style="info" %}
Everything on this page is managed at tenant level.
{% endhint %}

### Tenant isolation

Gracie only works with data in your tenant.

{% hint style="success" %}
Gracie reads, reasons over, and writes back to **your tenant's data only**.
{% endhint %}

This means:

{% columns %}
{% column %}

#### Data residency

Your data stays in your AWS region.
{% endcolumn %}

{% column %}

#### No cross-tenant sharing

Gracie is tenant-isolated end to end. Data from one tenant is never visible to another.
{% endcolumn %}
{% endcolumns %}

{% columns %}
{% column %}

#### No model training on your data

SureCloud does not use your tenant data to train or improve the underlying AI models.
{% endcolumn %}

{% column %}

#### Tenant-owned knowledge

Your knowledge base and AI context stay within your tenant.
{% endcolumn %}
{% endcolumns %}

### Access and permissions

Admins can enable or disable Gracie at tenant level.

Where Gracie is enabled, admins can also control:

* **Who can open Gracie** — restrict access by role or group.
* **What Gracie can see** — Gracie inherits the current user's permissions.
* **What Gracie can change** — actions use the current user's existing write access.

{% hint style="success" %}
Gracie never escalates privileges. She can only do what the current user is already allowed to do.
{% endhint %}

### Human approval

Gracie can draft, suggest, and prepare actions. Users stay in control of whether those actions are approved.

{% stepper %}
{% step %}

#### Gracie proposes

When Gracie is asked to do something consequential, she presents it as a **proposed** action in chat.
{% endstep %}

{% step %}

#### The user reviews

The user reviews the action and approves or rejects it.
{% endstep %}

{% step %}

#### The action executes (or doesn't)

Only approved actions are executed. Proposed, approved, rejected, and executed states are all logged.
{% endstep %}
{% endstepper %}

This keeps a clear record of who approved what and when.

### Explainability

Gracie responses can reference the records, policies, controls, risks, and evidence used to form them.

Alongside the reasoning view in chat, this gives users the data behind the response and the steps used to reach it.

{% hint style="info" %}
Explainability is a control. It helps users and reviewers validate why Gracie returned a result or proposed an action.
{% endhint %}

### Logging and auditability

Gracie activity is logged end to end, including:

* What Gracie generated.
* What the user changed.
* Who approved the final output.
* Which data Gracie referenced to produce it.

That means you can:

* Produce an audit trail of AI activity.
* Trace a record change back to the chat turn or agent run that caused it.
* Monitor adoption across teams.

### Credit usage

Gracie exposes **credit usage** at both user and tenant level.

{% columns %}
{% column %}

#### User view

Users can see their own credit usage and the usage of others.
{% endcolumn %}

{% column %}

#### Tenant admin view

Admins can see aggregated usage across the tenant.
{% endcolumn %}
{% endcolumns %}

{% hint style="warning" %}
When a limit is reached, Gracie stops performing new AI operations until the limit is raised or the period resets.
{% endhint %}

### At a glance

<details>

<summary>Key governance controls for Gracie</summary>

* **Tenant-scoped data only.** Gracie operates only on your tenant's data. Information is never passed between tenants.
* **Data residency.** Your data does not leave your AWS region.
* **No model training on your data.** Your tenant's data is never used to train or improve the underlying AI models.
* **Permission-aware.** Gracie enforces your existing role-based access rules; she can't surface data the user couldn't already see.
* **Tenant control.** AI can be enabled or disabled at tenant level, and restricted by role or group.
* **Human approval.** Gracie drafts and suggests. Users approve.
* **Full explainability.** Every response references the underlying source data.
* **Complete audit trail.** Every AI interaction — proposed, approved, rejected, executed — is logged.

</details>