Shoris trust centre
Shoris scopes agents around minimum access, explicit human approvals, observable activity, and a controlled first deployment.
Updated 14 July 2026
Plain-language policy
This page explains the current Shoris website and agent-scoping process. A signed client scope may add project-specific terms.
This page describes intended delivery controls. It does not claim ISO 27001, SOC 2, CERT-In empanelment, DPDP certification, or an independent security audit. Project-specific controls are verified against the selected architecture before production access is granted.
Each deployment starts with one workflow. The agent should receive only the systems, fields, and actions required for that role. Broader permissions require a documented operating reason.
API keys, service-role credentials, tokens, and privileged operations must remain in protected server environments. They are not placed in client-side code or shared through public proposal pages.
Sensitive, irreversible, low-confidence, or policy-exception actions are defined before launch and routed to an accountable human owner instead of being guessed or executed silently.
Normal cases, failure paths, fallback behaviour, and access controls are tested before controlled release. Logs and KPI reviews support investigation and operating improvement.
Security requirements vary by system and data category. Before production deployment, Shoris confirms actual integrations, data flow, retention needs, permissions, logging, backup and recovery expectations, incident contacts, and any customer or regulatory notification duties in the written scope.
Share the workflow and the exact data or system concern you want reviewed.
