Observe before touching
Assessment begins with reader roles or configuration exports. We verify effective permissions before the first piece of evidence is collected.
The Flowcraft control model
AI-assisted. Human-controlled.
Read-only by default. Changes only with your written approval.
AI accelerates collection, comparison and drafting. It does not inherit the keys. People make the decisions; every intervention is authorised, traceable and proven after the fact.
- FrameSystems, identities, data and boundaries fixed in writing.
- ObserveRead-only review with AI-assisted evidence collection.
- NavigateFindings translated into risk, ownership and an executable sequence.
- AuthoriseYou release each change, its window and its rollback path.
- ProveThe change is made, the control re-tested and the evidence handed over.
Control architecture
Permission is designed, not assumed.
Every change crosses a gate
No intervention moves without written authorisation naming the systems, the change window and the route back.
Temporary authority, named owner
A named account in your tenant, protected by MFA and elevated just in time; never an anonymous identity or a standing privilege after handover.
A trace, not a mystery
Observations, decisions and interventions leave a navigable record, so the story of a change can be reconstructed.
AI in a bounded lane
We use enterprise AI services under terms that exclude training on your data. AI drafts and suggests; it never acts on your systems without human approval.
Proof after intervention
After each change, we re-test the control and record both the result and any residual risk. Completion is evidence, not assumption.
Remote delivery
We come to your environment. Your data stays there.
When work happens inside your systems, it happens through a session you control. Only screen and keyboard traffic crosses the connection; your files, databases and mailboxes stay on your systems. We keep only the deliverables you agree to receive.
Your own access path
A named, MFA-protected account on your VPN, Azure Bastion, Azure Virtual Desktop or Citrix. Cloud consoles are reached in a browser with a time-limited role. Nothing new is installed on your side.
Attended remote session
For smaller environments, a commercial remote-support tool with session logging. You start the session, watch it and can end it at any time.
Our tooling stays on our side
The FlowCraft AI agent and browser extension run on our own hardened workstation and work through the session. No Flowcraft agent is installed on your systems.
- Sessions are not recorded or stored by Flowcraft unless you ask for a recording.
- FlowCraft AI reads the session screen to assist. That screen content is processed by enterprise AI services under terms that exclude training on your data. You can ask for any engagement to be delivered without AI.
- Access is removed at handover, and any working data we hold is deleted within 14 days of close.
Want to test this control model against your environment?
Tell us where the boundary feels unclear. We will show you how access, approval and evidence would work before the engagement begins.