Security and governance

Control over data, access and decisions.

CityTac is designed for contexts where confidentiality, accountability and traceability are non-negotiable. Security covers the data, the people who access it and the AI agents that work on it.

01Four principles

Security by design, not as an add-on.

  1. 01

    Least privilege

    • Defined roles for every user
    • Permissions per individual function
    • Access limited to areas of responsibility
    • Immediate revocation of access
  2. 02

    Traceability

    • Log of every change
    • Author and time of every action
    • Distinction between human and automated actions
    • History available for debriefing
  3. 03

    Human decision

    • AI proposals require approval
    • No autonomous agent actions
    • Accountability always attributable
    • Option to reject and give reasons
  4. 04

    AI control

    • Permissions for every MCP tool
    • Explicitly authorized agents
    • Access only to the data needed
    • Free choice of model and vendor

02Commitments

  1. 01

    No operational decision is made by an algorithm.

  2. 02

    Every access to data has someone accountable.

  3. 03

    What is not needed is not visible.

03Data protection

Operational data handled with the utmost care.

Scenarios contain sensitive information: the platform is designed to show it only to those who are authorized, and only when needed.

  • Separation between agencies

    Each organization works on its own scenarios, kept separate from those of other agencies.

  • Need-to-know visibility

    Information is shown according to role and function.

  • Defined retention

    Scenario retention periods are set with the agency, according to its rules.

  • Shared configuration

    Deployment and data management arrangements are defined during activation, based on the organization's requirements.

04Frequently asked questions

The answers, in brief.

01

Can AI agents access all the data?

No. In CityTac, each AI agent accesses only the MCP tools and the data for which it has been authorized by the agency.

02

Are actions in CityTac tracked?

Yes. In CityTac, every change and every proposal, human or automated, is logged with its author and time.

03

Who is responsible for operational decisions?

Always an authorized person. CityTac supports the decision but does not replace it: AI agent proposals require an operator's approval.

04

Where is the data stored?

CityTac's deployment and data retention arrangements are defined with each agency during activation, based on its security requirements and applicable regulations.

Request a demo

Let's talk about your security requirements.

In the demo we go into detail on roles, permissions and AI agent governance.

Request a demoExplore the AI integration