The hardest part of connecting a business's systems into one intelligence layer is not the connecting. It is making sure the layer never shows a person something they could not already see through the front door. That constraint shapes every architectural decision underneath it.
Identity first, always
Every request resolves who is asking before any data is read. Not after, not as a filter on the answer, before. It reads as the authenticated user, through your systems' own access controls, exactly as if that person had logged in and looked themselves.
Live where it matters, materialised where it does not
Anything that must be current or permission sensitive is read live from the source at the moment of the question. Only durable, derived content, the kind that does not change minute to minute and carries no fresh permission risk, ever gets materialised into something faster to serve. Real time access to live systems is becoming the baseline expectation for enterprise AI in 2026, not an advanced feature reserved for the most security conscious buyers.
No new access path
The single hardest constraint, and the one most AI tools quietly break: the layer must create zero new ways to access data that did not already exist. Granular access controls that mirror what is already true, not a fresh permission model bolted on top, are what separates a governed intelligence layer from a new liability wearing a dashboard.
It reads as the authenticated user, through your systems' own controls. Where data must be current or authoritative, it reads live rather than from a stored copy, so answers are fresh and permissions are never stale.
What this rules out
A single shared answer for everyone who asks the same question. A cached response that outlives a permission change. Any shortcut that trades a moment of speed for a gap in access control. Those trade-offs are common in AI products built to ship fast. They are not compatible with an intelligence layer meant to sit over a real business, permanently.