> ## Documentation Index
> Fetch the complete documentation index at: https://docs.rallied.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Security and trust at Rallied

> How Rallied keeps AI agents safe on real PSA and Microsoft 365 tenants: approval policies, scoped plans, MFA bad-actor checks, and a full audit trail.

Giving an AI write access to your PSA and your clients' Microsoft 365 tenants should make you nervous.

Here's the problem: LLMs aren't deterministic. Ask one the same question twice and you can get two different answers. At scale, hoping the model behaves consistently isn't a plan.

So we didn't build on hope. Deterministic rules live in our platform, where the agent can't touch them.

## Rallied enforces the rules

Every action the agent can take has a setting: auto-approve, needs approval, or disabled. The platform enforces these, so the agent can't talk its way past a setting by rewording the request or reaching for a different tool.

This is the part most homegrown agents get wrong. Their guardrails live in the prompt, and a prompt is a polite request. The model can drift from it, and a cleverly worded request can talk it out of it.

## Write actions need approval by default

When you connect an integration, by default reads are automatic and writes require a human in the loop.

If you want to see how the agent thinks before giving it any power, run a new client in Plan mode. The agent works real tickets with read-only tools and posts what it would have done as an internal note. Once you trust its judgment, you let it act. We recommend this for every new client.

## Plans are tightly scoped

An approval isn't a blank check. Before anything runs, Rallied compares the action against the plan the agent showed you, value by value, and refuses it if a single value is different. The agent has to come back and request a fresh set of approvals.

## Bad actor detection

The oldest helpdesk scam is pretending to be someone else: call in, say you're an employee, ask for a password reset. So when a request touches credentials, admin rights, or permissions, the agent assumes it's talking to an impostor until the employee proves otherwise.

Proof is an MFA push to the actual employee through Duo, Traceless, or Microsoft Authenticator. The platform decides which requests are sensitive, and when it can't tell, it errs on the side of caution. If the push fails or times out, nothing runs, no matter what else was approved. While a check is open the agent can only post notes, and if the employee has no enrolled device, it hands the ticket to a person with a note on what happened.

## Credential storage

Your integration credentials are stored encrypted, and the agent never has access to them. When it uses a tool, the platform makes the API call and hands back just the result. Disconnecting an integration or deleting a client revokes the credentials.

Passwords get the same treatment. The agent can find one by name but can't search by value, and end users never see one in a ticket. If you want password text out of tickets entirely, turn on single-use links that destroy themselves after one view.

## Client separation

Every client gets its own agent, running in its own container, and it sees only that client's users, tickets, and runbooks.

Some credentials cover many clients, like Microsoft 365. There, every call names the client it's for, and the platform checks that name against the agent making the call. If the name is missing, unknown, or wrong, the call is refused.

## Audit logs

Everything the agent does is logged: every tool call, approval, and conversation. Refused actions are logged too, with the reason.

## SOC 2 Type II

An external auditor verifies our SOC 2 Type II controls. The latest audit period ended in July 2026, and the report is being finalized now. Our [trust center](https://trust.rallied.ai/) has the control list and our subprocessors, monitored continuously through Vanta.

## Build vs buy

You could build all of this yourself. A demo agent is a weekend project, which is exactly what makes it misleading, because the demo is the easy part. The policy engine, the approval workflow, the MFA checks, the credential store, the client isolation, the audit log: that work is the year after the weekend, and then someone on your team maintains it through every API change, forever.

The case for buying isn't that our agent is smarter than one you could wire up. It's that the controls around it already exist, and are on from your first ticket. They don't loosen as you grow, and you're live in days instead of months.

## Related pages

* [Plan mode](/agents/plan-mode)
* [Approval settings](/dashboard/policies)
* [Identity verification](/agents/identity-verification)
* [Activity and audit logs](/dashboard/activity)