How Aria keeps to
your permissions.

In short

• Aria reads your ERP with the permissions of the person asking. Nobody sees more through Aria than they could open in the Desk.
• Each question carries a pass your own site signs: who, which conversation, good for at most 15 minutes. Without a valid pass, Aria's reads are refused.
• Aria's own account has no document permissions. It can't read anything without a person's pass.
• Under a pass, Aria gets read tools only. Changes go through action mode: Aria proposes, and the person confirms on their own login.
• Every call lands in the Kremio Action Log with the person, Aria's account, the agent and the conversation or job.

The pass

For each question, server code on your site mints a short-lived pass, called an on-behalf-of claim, after checking that the person owns the conversation. Every call Aria's runtime makes to your ERP carries it, and your site checks it on each one. Neither minting nor checking can be called from outside your site.

• It's signed with HMAC-SHA256, under a key derived from your site's own encryption_key. Nothing new is stored, the key never leaves your site, and rotating the encryption key revokes every pass.
• It reads as kobo1.<payload>.<signature>. Change one character and it no longer verifies.
• Only enabled users who aren't Website Users can be named: System Users, and custom user types such as HRMS's Employee Self Service, who then see only what their user type allows. Portal users and Guest can't be named.
• Infinary's hub never sees the pass, and never sees who is asking.

Aria's own account

Aria reaches your ERP through Kremio Connect's MCP endpoint, as a machine user, infinary-aria@infinary.invalid. That account is built to be useless on its own:

• Its roles, Kremio Delegate and Infinary Aria, hold no document permissions and no Desk access, so it can't open the Desk even with a password.
• It calls with an API key. A browser session is refused.
• Every read needs a valid pass. A call without one is refused. It never falls back to the account's own view.
• For the length of each request your site switches to the person the pass names, then puts Aria's account back. Nothing about the person is saved in a session or a cookie.
• Its key is rotated together with the agent account's.

What Aria can call

Under a question's pass, Aria gets read tools only, such as get_document, list_documents, search_documents, global_search, generate_report and extract_file_content. Every check runs as the person: document permissions, field-level trimming and tool rules.

• Never the tools that submit, cancel or delete, whatever Kremio Settings allow.
• Never the System Manager tools, run_python_code and run_database_query, whoever is asking. Raw SQL would read past the person's permissions.

What a refusal looks like

Aria says what it can't see. It doesn't give a vague refusal or work around one.

The Action Log

Every call through Kremio Connect, from Aria, an agent, the Kremio app or an AI app you connected, writes a row to the Kremio Action Log on your site. Rows are kept for 90 days by default.

Filter by Thread or Job to see every call one conversation or one agent run made, failed ones included. Calls made without a pass, such as an AI app you connected over OAuth, leave Via, Agent and Thread or Job empty.

Agents: both must allow

Aria has no limit of its own: it reads what the person can. Infinary's catalog agents are different. Each one also has its own user, agent-<id>@infinary.invalid, holding one role whose permissions are exactly what the agent's manifest lists. It never signs in. It's a permission profile your site checks against.

• Under a pass that names an agent, a call must be allowed for the person and the agent's user: documents, fields, search results and reports. Neither can widen the other.
• Only the agent user's own role counts, never the automatic ones every user holds.
• When a new version of an agent asks for more access, it doesn't run until a System Manager approves the addition. A System Manager's own narrowing survives upgrades.
• Disabling an agent's user is its kill switch: every call naming it is refused at once.
• “Agents run as a person” is a setting in Infinary Controls Settings, off by default. When it's on, a run started from the ERP acts as the person who started it, and a scheduled run acts as the person a System Manager names for that agent. With nobody named, the run is refused. Its drafts belong to that person and stay private to them: a Note is never public, a ToDo goes only to them, and a Communication stays unsent.

So the Cash Forecaster, started by someone without payroll access, forecasts without payroll and lists it as unknown. And the Collections Clerk can't read a Salary Slip, even when the person it runs as can.

Limits from each agent's manifest in Infinary's catalog

What leaves your site

Aria runs inside your site and calls Google's Vertex AI from your own Google Cloud project. What Aria reads to answer you goes to the model to write the answer.

• Infinary's hub never sees who is asking, or their pass.
• A System Manager chooses which models your site allows. Gemini is the default. If your site allows Anthropic's Claude models on Vertex AI, those calls go to Vertex AI's global endpoint, so they aren't held to one region.
• An AI app you connect yourself, such as Claude through Kremio's Connect an AI app, sends what it reads to that app's own provider. That's separate from Aria, and it's logged the same way.
• Kremio doesn't keep Aria chats on the phone.

Versions and settings