Xerum for government and defence suppliers
Need-to-know, enforced where the results are found
Most search tools rank everything and then remove what you may not see. That works until the ranking, the result count or the latency tells somebody that the thing they were not shown exists. Here the filter is inside the query, before anything is ranked.
Sound familiar?
Post-filtering leaks by inference
Removing results after ranking is not compartmentalisation. Counts, gaps and timing all carry signal, and a system that hides a document while admitting it exists has already failed the requirement.
Multitenant is a non-starter
A shared index with a customer column is one query bug away from a cross-programme disclosure. For most buyers that is a risk; for this one it ends the evaluation.
Service accounts destroy attribution
An agent acting under a shared identity means the log records the robot, not the person. When the question is who accessed what, that answer is not an answer.
What changes
Pre-filter, never post-filter
What a person may see is enforced inside the index query, before ranking. A hidden resource is indistinguishable from one that does not exist.
Physical isolation per customer
Own container, own database file, own index directory, own storage prefix. There is no shared index for a filter bug to leak across, because there is no shared index.
User-bound tokens end to end
No service tokens are issued. An agent carries a token bound to a person, sees exactly what that person sees, and every action it takes is attributed to them.
A complete, immutable access record
Every change is recorded with its author and time, and nothing is edited in place — so the history of what the context said, and when, cannot be quietly revised.
What this industry buys
Scopes + isolation
The two requirements that usually disqualify a hosted tool, answered by the architecture rather than by a compensating control.
- Permission filtering inside the query, before ranking
- Hidden and absent are indistinguishable to the caller
- One container and one database per customer
- No service accounts anywhere in the system
Finer-grained scopes derived from source permissions are the next phase of work.
Compartmentalisation your architecture can actually defend
Built today, not on a roadmap. Every property above is already how the store works.