If it cannot be decided, stop

Hiding a button, banning something in the terms, catching it in review: none of these is protection. In OS iXanagi, every request — from a screen, the API, AI chat, automation or an outside AI tool — travels one path.

On that path, a signed-in request is checked in the same order every time:

• Who is asking (sign-in)
• Which company they belong to (verified membership)
• Whether the app is activated for the company
• Whether they own the scope they are asking about
• Whether they hold the permission the operation declares it needs
• Whether the input has the right shape

The kind of answer tells you why a request was stopped.

• A request about a brand or site you do not own gets "not found" (404). Another company's things do not exist for you.
• Missing permission on your own data gets "forbidden" (403).
• Input of the wrong shape gets "unprocessable" (422).
• When a check cannot read the data it needs to decide, the answer is "cannot decide right now" (503). Letting the request through could cross a boundary, so it stops.

Not everything stops. Decisions — is this allowed, is this the owner, is this a member — always stop when the answer is unknown.

Work that rides along with the main operation, such as marking related explanations for review, is different. If it fails, the main operation goes on and the failure is written to the server log, because stopping would do more harm than good. Which kind each piece of work is has been decided in advance.

A system that swallows errors and keeps going lets mistakes spread silently. By the time anyone notices, nobody can tell where things went wrong.

When you can see where something stopped and why, you can fix the cause. The AI's path goes through the same checks: the AI writes with the permissions of the person who asked, and reads only within the company's scope.