Security and governance
Security for an AI team in a small business
An AI team can go wrong in three ways. A wrong answer reaches a customer. Private data ends up in the wrong place. An agent does more than you asked. This page lists the controls we put in every setup, and what we do not have.
The risks
What can go wrong with an AI team
An agent is software that reads, writes and acts for your business. Three failures matter most, and each control below answers one of them.
- A wrong answer reaches a customer. An agent drafts a quote with the wrong price and nobody reads it before it goes out.
- Private data ends up in the wrong place. A customer list or a staff record gets pasted into a tool you did not choose.
- An agent does more than you asked. It changes a file, or uses an account, that the job never needed.
The controls
What we put in every setup
Six safeguards, whatever the skills do. You can check each one yourself.
- Access limited to what the skill needs
- Each skill works in your own repository and your own accounts, and uses only the access its job requires. You give us that access within 5 days of the start date.
- Your data stays with you
- Your files and your skills live in your GitHub repository. Your team uses Claude through your own Anthropic account, which bills you directly.
- A person signs off on the work that matters
- An agent prepares the work and a person on your team approves it before it goes out.
- A signed acceptance test for each skill
- You sign the test before we start work on the skill, and it decides whether the skill works. It is also the basis of the guarantee.
- A change history in your repository
- Skills are files, and GitHub records every change to them: who made it, when, and what it replaced. You can go back to an earlier version.
- A way to report a problem
- Found a vulnerability? Write to info@whiteglovelabs.ai. The same contact is published at /.well-known/security.txt. We acknowledge reports and agree a disclosure timeline with the reporter. We will not pursue researchers who act in good faith and stay out of data that is not their own.
Limits
No security certificate today
Warning
No attestation, no logos
White Glove Labs holds no third-party security attestation today. We show no certification logos, and this site has no certification wall. Where a control belongs to a provider such as Anthropic or GitHub, it is theirs, and we point you to their documentation. If a contract of yours needs an attestation, say so on the call and we will tell you where we stand and what it would take.
Reference
Six stages and twelve control domains
Show the twelve control domains
This is the checklist behind the controls above, for an accountant, lawyer or insurer who asks for it. The grouping is ours. It is not a published standard, it carries no accreditation, and no authority has reviewed it. The six stages are the architecture we design against. The twelve domains cover the same ground in more detail, plus four that wrap the whole system.
| Control domain | Architecture stage | In plain words |
|---|---|---|
| 1. Accountability and decision rights | No stage: wraps the system | Who answers for what the agents do. |
| 2. Workflow and impact assessment | No stage: wraps the system | Which jobs suit an agent, and what a mistake would cost. |
| 3. Data classification, privacy and records | 01 Approved sources and data classification | What data is private, and what records you keep. |
| 4. Identity, roles and least privilege | 02 Identity, roles and least-privilege tools | Which person or tool may use which account. |
| 5. Model, prompt, tool and connector controls | 03 Model and prompt controls | Which model, instructions and tools each agent may use. |
| 6. Grounding, provenance and citations | 03 Model and prompt controls | Answers that show where they came from. |
| 7. Evaluation and red-team testing | 04 Evaluations and acceptance thresholds | Tests with a pass mark, and attempts to break a skill. |
| 8. Human approval, uncertainty and escalation | 05 Human approval and escalation | A person approves the work that matters, and the agent hands over what it cannot settle. |
| 9. Monitoring, audit, cost and change control | 06 Monitoring, audit, incident and change | A record of what the agents did, what it cost and what changed. |
| 10. Incident response, rollback and service continuity | 06 Monitoring, audit, incident and change | A plan for when something goes wrong: stop, undo, carry on. |
| 11. Accessibility and official languages | No stage: wraps the system | Work your team and your customers can use, in either official language. |
| 12. Supplier and shared responsibility | No stage: wraps the system | Who answers for what between Anthropic, GitHub and us. |
Next step
Start with a 30-minute call
Tell us what your team does each week, and ask us anything on this page. We say which package fits, or that none of them do yet.