Private Knowledge Plane

The Private Knowledge Plane is the isolation framework that governs how tenant corpora are stored, accessed, and selectively shared across the CueCrux platform. It provides the policy layer that sits between VaultCrux's encryption infrastructure and the business rules that determine who can access what knowledge under which conditions.

At the most restrictive level, tenant-only corpora are completely private. Only authenticated members of the owning tenant can access the content, and all queries are scoped to that tenant's data. The knowledge never leaves the tenant boundary, and even platform operators cannot read the encrypted content. This level is suitable for highly sensitive proprietary information such as trade secrets, unreleased research, or confidential client data.

Partner-shared corpora enable controlled knowledge sharing between organisations that have formal agreements. A law firm and its corporate client, for example, might share a subset of their knowledge to enable joint research workflows. The Private Knowledge Plane manages the access policies for these shared spaces, specifying which content is shared, with whom, and under what conditions. Access grants can be time-limited, revocable, and scoped to specific knowledge domains or document types.

Licensed access tiers support a marketplace model where knowledge owners make their content available to other tenants for a fee. Usage is metered at the chunk level, with VaultCrux tracking every retrieval event and attributing credits to the content owner. The Private Knowledge Plane manages the licensing terms, ensuring that licensed content is only accessed in accordance with the agreed terms and that usage data flows accurately into the billing system.

Encryption at rest is enforced across all tiers using HashiCorp Vault Transit. Each tenant has its own encryption key, and key rotation occurs on a configurable schedule without requiring re-encryption of the entire corpus. The key management infrastructure supports key escrow arrangements for regulatory compliance and disaster recovery scenarios.

Audit-logged access trails record every access event with the identity of the accessor, the content accessed, the time, and the purpose. These logs are immutable and exportable, supporting compliance audits and access reviews. In regulated industries where demonstrating who accessed what information and when is a legal requirement, these trails provide the necessary evidence.

The Private Knowledge Plane integrates with the Canvas White-Label framework to ensure that white-label deployments inherit the same isolation guarantees. It also connects with the VaultCrux Frontdoor to manage access for external users who interact with shared or licensed content through the public-facing portal.

For the CueCrux platform, the Private Knowledge Plane is what makes private knowledge usable in a shared infrastructure environment. It solves the fundamental tension between wanting to leverage AI-powered retrieval over sensitive data and needing to maintain strict access controls and data sovereignty.