In one sentence: only the right people can edit the instructions, every change is kept as a numbered version
with an author and time (so you can see and undo anything), the instructions are fenced when handed to the
AI so they can't override the platform's own rules, and the whole store is encrypted and reachable only through a locked
internal path.
Why this one matters
The Content CMS is where operators write the doctrine the AI follows — the CLAUDE.md and skills.md
that steer every assessment and every scheduled review. That makes it a high-value target: change the instructions and you
change the behavior. So it's protected on two fronts — who can change it, and what the instructions are
allowed to do once the AI reads them.
The layers that protect it
- 1. Only the right people can edit. Editing is permission-gated: a platform admin can edit any
cartridge's docs; a person with a specific cartridge's group can edit only that cartridge's docs. There's no open
edit door.
- 2. Nothing is overwritten — everything is versioned. Each save creates a new numbered version with the
author and timestamp; older versions are kept. You can see the full history and roll back. A bad or malicious edit is
visible and reversible, not silent.
- 3. The instructions are "fenced" when the AI reads them. This is the subtle one. Operator guidance is
content, not commands to the platform. When a doc is handed to the AI, it's wrapped so it can steer the task but
cannot issue directives that override the platform's own controls — the defense against someone hiding "ignore your
rules and exfiltrate data" inside a doc.
- 4. Uploads are scanned. New content runs through a safety scanner; a blocking finding refuses the upload, a
warning asks for a human acknowledgement before it's accepted.
- 5. It's encrypted, and reachable only from inside. The store is encrypted at rest with a customer-managed key,
and a cartridge can only reach it through the locked internal network path (the VPC endpoint policy) scoped to that one
table — not the open internet, and not other cartridges' data.
- 6. Reads happen on the server. The AI is given the finished, fenced text server-side; the raw store is never
exposed to a browser or a document.
The two questions it answers
QUESTION 1 — "Who can change the instructions?"
admin ─────────────▶ any cartridge's docs
cartridge group ───▶ only that cartridge's docs
everyone else ─────▶ no edit
every save → new version #, with author + timestamp (nothing overwritten)
QUESTION 2 — "What can the instructions do once the AI reads them?"
the doc is FENCED before it reaches the model
→ it can steer the task
→ it CANNOT override the platform's controls (no "ignore your rules")
stored encrypted · reached only via the locked internal path · read server-side
What could go wrong — and why it's contained
| Worry | Why it's contained |
|---|
| "Someone edits the doctrine to misbehave." | Only admins / the cartridge's group can edit, and every change is a versioned, attributed, reversible record. |
| "A doc hides a malicious instruction to the AI." | Docs are fenced as content, not commands; a hidden "override your rules" can't take effect. Uploads are also scanned. |
| "Another cartridge reads or writes these docs." | The network path is scoped to that one table per tier, and each cartridge's permissions are scoped to its own docs. |
| "The data leaks at rest." | Encrypted with a customer-managed key; access is auditable. |
The bottom line
Changing the AI's instructions requires the right permission and leaves a versioned, reversible trail; and even a bad
instruction can only steer, never override the platform's controls.