# SweetHive & the EU AI Act

> **AI by design. Governance by design. Privacy by design.**

SweetHive was designed from the ground up as an AI-native collaborative
platform - not a traditional collaboration tool with AI added later. Its
architecture aligns naturally with many core principles of the **European Union
AI Act (Regulation (EU) 2024/1689)**: governance, human oversight, security,
privacy, and controlled access to information.

Compliance ultimately depends on the specific AI models and use cases each
organization deploys. What SweetHive provides is a technical foundation that
significantly simplifies AI Act compliance.

## AI scoped by design

The AI Act encourages organizations to minimize unnecessary access to data and
reduce the potential impact of AI systems. SweetHive implements this principle
at its architectural core.

Every AI agent operates inside a strictly defined scope:

- only the hives, [contexts](/en/contexts/) and sub-contexts explicitly granted;
- only information already visible to the requesting user;
- only for the capabilities assigned to its token.

On every request, the effective permissions are the **intersection** of:

- the user's current permissions;
- the token's configured scope.

An AI assistant can therefore **never access information beyond what its owner
can currently see**. If a user loses access to a context or [group](/en/groups/),
every connected agent loses the same access instantly - no token regeneration
required.

## Principle of Least Privilege

Every connection to SweetHive follows the **Principle of Least Privilege**, a
fundamental security principle recommended across European cybersecurity and AI
governance frameworks. Agents receive only the minimum permissions needed for
their task.

Available capabilities are:

- **Read**
- **Read + Draft**
- **Read + Post**

Organizations decide which capabilities are allowed within each hive, and
administrators may restrict or completely disable external AI agents. See
[Connect an agent](/en/connect-an-agent/) for how capabilities and scope are
assigned.

## Human Oversight

A key requirement of the AI Act is that humans remain in control of AI-assisted
decisions and actions. SweetHive is designed around this principle.

An agent can draft messages, summaries or reports, but **publishing content
always remains under human control**. For agents with **Read + Post**
capability:

- the exact message is shown to the user;
- publication requires explicit confirmation;
- every published message is attributed as being sent **via the user**.

This is a true **human-in-the-loop** workflow, not autonomous publishing.

## Privacy by Design

Privacy is embedded throughout the platform:

- scoped access tokens;
- immediate token revocation;
- live permission evaluation;
- read-only connectors by default;
- encrypted secret storage;
- server-side credential management;
- optional local AI inference through [SweetHive Agents Node](/en/agents-node/).

When local models are used, prompts and data remain on the user's computer
during inference - significantly reducing privacy risk and data transfers.

## Secure AI connections

SweetHive exposes its AI capabilities through secure, MCP-compatible connectors.
Every AI connection uses:

- scoped tokens;
- configurable expiration;
- revocation at any time;
- capability-based permissions;
- continuous permission verification.

A leaked token never exposes an entire account. Its reach stays limited to the
configured scope, the owner's current permissions, and the assigned
capabilities.

## Transparency

Users always know:

- which AI agents are connected;
- which contexts they can access;
- which capabilities they hold;
- when they were last used;
- whether they are currently online.

Organizations retain full visibility of, and control over, connected AI systems.

## Auditability

SweetHive provides accountability features that support governance requirements:

- last token usage;
- capability information;
- expiration dates;
- online status;
- one-click token revocation;
- attribution of AI-generated posts.

These mechanisms help organizations build auditable AI workflows and demonstrate
operational control.

## Context-aware security

Unlike traditional chat systems where an AI often receives access to large
collections of documents, SweetHive organizes information into hierarchical
contexts protected by groups. Visibility always flows through the organizational
structure.

This naturally limits AI exposure and dramatically reduces accidental
information leakage. The result is an AI system that understands organizational
context **without** requiring unrestricted access to organizational knowledge.

## Alignment with the EU AI Act

SweetHive is engineered to support many of the principles promoted by the
European AI Act:

| AI Act principle | SweetHive implementation |
|---|---|
| Data minimization | Scoped contexts and group-based visibility |
| Human oversight | User confirmation before AI publishing |
| Least privilege | Capability-based scoped tokens |
| Transparency | Visible connected agents and permissions |
| Accountability | Token tracking and AI attribution |
| Privacy by design | Local inference, scoped access, secure connectors |
| Security by design | Dynamic permission enforcement and immediate revocation |

## Compliance notice

The European AI Act regulates the **deployment and use** of AI systems, rather
than collaboration platforms themselves. SweetHive provides an architecture that
supports AI governance and regulatory compliance, but the obligations applicable
to a specific deployment ultimately depend on:

- the AI models being used;
- the intended use case;
- the organization's governance processes;
- applicable national and European regulations.

Organizations deploying AI in high-risk scenarios should complement SweetHive's
technical safeguards with appropriate risk management, documentation, monitoring
and governance procedures, as required by the AI Act.

## Built for responsible AI

Rather than treating AI as an isolated chatbot with broad access to
organizational knowledge, SweetHive integrates AI into a secure collaboration
environment where every action is governed by the same visibility rules,
permissions and organizational structure users already trust.

The result is AI that is:

- **secure by design**
- **private by design**
- **governed by design**
- **human-controlled by design**
- **ready for enterprise AI adoption**