Coherent Assistant - Security Posture for AI and Agents

Coherent Assistant is a Microsoft Excel task-pane add-in that lets users work on their workbooks with AI assistance inside controlled, security-conscious workflows, including in regulated environments. Its architecture keeps workbook processing local, routes AI traffic through a Coherent-controlled gateway, requires explicit user approval before an agent changes a workbook, and records the activity needed to review AI-assisted work.

Local processing and data minimisation

Workbook reading and extraction are performed locally, inside the user’s Excel session, using the Excel JavaScript API and a WebAssembly-based extraction engine. There is no server-side extraction path: the add-in itself converts the open workbook into the structured view the AI works with.

When an agent performs a task, the information transmitted to the model is the task-relevant context - the specific cells, formulas, and structure the agent reads for that task - sent through Coherent’s AI gateway. Tabular analysis is likewise performed locally through an in-browser, read-only SQL engine, so datasets can be filtered and aggregated without leaving the user’s machine.

Conversation transcripts, attachments, and workflow run state are stored locally in the user’s browser profile (IndexedDB and the browser’s private file system). They are not synchronised to the Coherent cloud. Completed guided-review runs are pruned automatically, retaining only the most recent runs, and unreferenced attachment content is garbage-collected.

Distinct, user-initiated product operations - such as publishing a workbook to Coherent Spark - do transfer workbook content to the relevant Coherent service. These are explicit, visible actions, and the corresponding agent tools are only registered where the customer’s Spark environment is configured.

AI data handling

All model traffic is routed through Coherent’s controlled AI gateway. The add-in embeds no model-provider API keys: every request is authenticated with the signed-in user’s own single-sign-on token, so AI access is governed by the same identity, tenancy, and entitlement controls as the rest of the platform, and each request is attributable to a user. Requests are additionally tagged with the originating application.

The gateway presents an OpenAI-compatible interface and fronts the configured model providers. The model used is selected per conversation from a curated catalogue. Web search and search-grounding requests transit the same gateway rather than being sent from the client directly to third-party AI services.

The application’s monitoring is limited to error and performance telemetry; the application does not log prompt or response content to its monitoring systems. Retention arrangements with the underlying model providers are managed at the gateway layer and are confirmed for the customer’s deployment during due diligence.

Agent controls

Coherent Assistant agents operate within defined workflows rather than with unrestricted autonomy. Controls include:

• Task-specific, least-privilege tool access - capabilities are registered only where the corresponding host or client is present (Excel-specific tools only inside Excel; Spark tools only where a Spark environment is configured), and review-pipeline agents receive per-role tool allowlists, with some stages running with no tools at all

• Governed system instructions - every agent receives layered, product-managed instructions, including an explicit direction to treat customer data as confidential and customer models as production assets

• Sandboxed code execution - free-form code proposed by an agent runs inside a hardened JavaScript compartment (SES lockdown) that exposes only an explicit allowlist of globals, with dynamic-code and reflection escape hatches removed

• Controlled web access - URLs are validated to public HTTP(S) endpoints, with private, loopback, and internal network addresses blocked; fetched page content is treated as untrusted data, with explicit prompt-injection countermeasures in the agent instructions; all web requests are time-limited

• Validation of structured outputs - agent findings and workflow outputs are validated against schemas before downstream use

• Ephemeral sub-agents - delegated sub-agent runs are transient, and nothing from them persisted by the application

Agent orchestration and workbook extraction run within the user’s Excel session. Where AI inference is required, the relevant task context is transmitted through Coherent’s controlled AI gateway to the configured model provider.

Workbook changes require explicit approval

Agents cannot silently modify a workbook. Every mutating operation passes through an approval gate that presents the action’s description and risk level to the user and proceeds only on explicit approval. For high-risk operations - such as executing generated code against the workbook — the approval dialog shows the actual code before the user decides.

The approval mode is selected by the user and persists with their session:

Approval mode	Behaviour
Read-only	Every proposed workbook change is automatically rejected; the agent can analyse but never modify
Ask (default)	Each proposed change is presented with its description and risk level, and proceeds only on the user’s explicit approval
Auto-approve	An explicit user opt-in that approves the agent’s changes automatically for that user’s session

Read-only mode gives reviewers a guaranteed non-mutating way to run agents against production workbooks. This places a preventative control at the point of change, rather than relying only on detection after the event.

Review, rationale, and auditability

Coherent Assistant records the basis for AI-assisted work rather than only its output:

• Conversation record - the full conversation, including tool calls and their results, persisted verbatim as the stored record of each session

• Guided workbook review - review runs through a fixed multi-stage pipeline (change summarisation, deterministic finding triage, independent verification, focused review) rather than a single free-running agent

• Findings with rationale - findings are recorded through schema-validated tools with severity, location, rule, and message; verification is evidence-conservative, and dismissing a finding requires an explicit written rationale

• Embedded audit trail - review status, run history, and findings (each with type, location, message, status, response, and timestamp) are recorded with the workbook record, so the basis for an AI-assisted conclusion remains inspectable

AI-generated assessments remain subject to appropriate human review, particularly where they support material, regulated, or customer-facing decisions.

Access control and tenant isolation

Authentication is delegated to an OIDC identity provider using per-tenant realms. Tokens are refreshed on a short cycle and expire with the user’s session, and the same tenant credential authorises AI, knowledgebase, and platform requests, so AI features carry no separate, longer-lived credential. Agent and review surfaces are additionally gated by role and entitlement, so tenants control which users can access them at all.

Customer control and deployment options

The platform’s AI layer targets an OpenAI-compatible interface with a configurable gateway address, making customer-managed AI gateways and alternative OpenAI-compatible endpoints feasible patterns. Deployment-specific behaviour — including telemetry destinations — is supplied through per-environment configuration rather than being fixed in the client. The specific configuration is agreed through customer-specific scoping.