--- title: "An AI tool your IT can actually allow · AssistantGeneral" description: "The admin console that runs on your own machine, and the policy it enforces on every desk." url: "https://royalsoftworks.com/products/assistant-general/security/governance/" source: "https://royalsoftworks.com" format: "markdown" note: "Markdown rendering of the HTML page at `url`. Same content, same canonical URL." --- Security & privacy · 3 of 4 # An AI tool your IT can actually allow. The admin console that runs on your own machine, and the policy it enforces on every desk. For IT departments ## An AI tool your IT can actually allow. For organisations, AssistantGeneral comes with an admin console that runs on one of your own machines, inside the office. IT decides exactly what each team can use and sees a full activity record — with no vendor cloud in between, and nothing done to a desk without the person at it knowing. 01 ### Exact permissions Decide which models, tools, data, workspaces and even screens each team can use — down to a single connector or website. The rules are enforced on every computer and stay in force when the console is out of reach. Policy pushed to managed clients, enforced locally and stored on each desk; per-connector, per-tool and per-website limits. 02 ### Nothing behind anyone’s back Anything an administrator does on someone’s computer — running a tool, fetching a file, changing settings — shows up for that person. There is no way to quietly search their documents. Admin actions recorded on the desk and shown in its notifications; no remote database query. 03 ### A record you can check See what was used across the whole organisation from one console, with a read-only role for whoever audits it. The record holds actions, not content. Fleet-wide audit, each entry chained to the last; auditor role; shared knowledge bases; per-team workspaces and practice packs. 04 ### Company sign-in, in pilots Staff can log in with the company account they already have, with starters and leavers synced automatically — switched on per organisation during a pilot. OIDC single sign-on and SCIM provisioning. No SAML or LDAP sign-in yet. [Previous Kept at arm's length, and offline.](https://royalsoftworks.com/products/assistant-general/security/contained/) [Next Compliance that comes from the architecture.](https://royalsoftworks.com/products/assistant-general/security/compliance/) [All of AssistantGeneral security](https://royalsoftworks.com/products/assistant-general/security/)