How Lattuss works
One map of who can reach what, and every agent call checked against it.
Lattuss works in three stages. The Scan maps what your agents could reach before they go live, Watchdog checks what they do once they are live, and Enforcer controls what comes back. The Scan is in beta, and Watchdog and Enforcer are open to early design partners.
How Lattuss reads your permissions.
Lattuss connects to each of your systems, reads who has access to what, and combines it into one map. The Scan, Watchdog and Enforcer all work from that map.
Read
Connectors read the permissions your systems already hold: file and folder access, sharing rules and role hierarchies, database grants, and group membership, including groups inside groups. We start with your identity provider, because it is what links one person's accounts across every other system. Access is read-only, you choose what each connector can see, and you can revoke it at any time.
Reconcile
Roles, sharing rules, groups and grants mean something slightly different in every system. Lattuss reconciles them into one map of who can reach what, and finds the access that only appears when two systems are read together.
The map is built from identifiers, not names. It describes your organisation without holding a copy of it.
Scan, Watchdog, Enforcer.
Start with the Scan to find out what your agents could reach. Add Watchdog once they are live, then Enforcer when you want the verdicts applied.
Scan
The Scan reads the permissions your systems already hold. It is not connected to your agents, so no traffic passes through Lattuss and nothing in production changes.
For each person, you get what they can reach and what an agent acting for them would inherit. That includes old access nobody uses any more. Because it is never used, it rarely gets questioned in an access review.
What your agents could reach, before you switch one on.
Watchdog
Every call an agent makes is checked against the person it is acting for, and the verdict is written down. In shadow mode the call still goes through, so you learn what would have been withheld before anything is.
One question from an agent can touch several systems. Watchdog keeps it as a single record, from the question to the answer.
What your agents do, checked against the person they act for.
Enforcer
Enforcer applies the same verdicts Watchdog records. The permission check is built into the search itself, so an agent only searches what the person it acts for could have found on their own.
You turn it on one system at a time, in the order you choose, after Watchdog has shown you what it would have withheld.
Agents only get back what the person behind them could see.
The decision happens in the query.
A filter checks an answer after it has been put together. Lattuss decides what goes into the answer in the first place, so data the person should not see is never pulled in.
“What do we know about this customer?”
- Collaboration
- CRM
- Warehouse
- Support
- HR
- Billing
One answer, scoped to the person who asked.
And a record of what was returned, what was not, and why.
What we read, and what we never touch.
Connectors are built around the systems you actually run. Each one reads only what that system already holds.
| Category | What we read |
|---|---|
| Identity | Your identity provider and the directories behind it: users, groups, and nested group membership. |
| Collaboration | Site, library and item level ACLs, and what those items inherit. |
| CRM | Sharing rules, role hierarchy and object level access. |
| Warehouse | Role grants at database, schema, table, row and column level. |
| HR | Worker record access policy and reporting lines. |
| Service desk | Queue membership, ticket visibility and the groups behind both. |
- We do not replace your identity provider, your DLP, your posture tooling or your data platform’s own grants.
- We do not read content. No documents, messages, records, tickets or attachments.
- We do not write to your systems.
- We keep the shape of your access. The names stay with you.
Read the stage you are at.
Each has its own page with the details.