Limiting what one compromised account can reach in a deal room

What compartmenting is worth when one account is misused

The useful question about any deal room is short: if one ordinary account is misused, by its holder or by someone who has taken it over, how much confidential material does it reach?

In CogniSuite the answer starts at one deal. Every transaction is a separate database served from its own subdomain, with its own users, sessions, access grants and audit trail. A session on one deal is not a session on another. Document reads and AI retrieval run against that deal's database only, so there is no per-room setting that has to be configured correctly to keep deals apart.

Inside a deal, reach is set folder by folder for the client and counterparty organisations. Every folder resolves to one of four grades for a given person: full, watermark, view or none, plus a separate right to upload. Reading a file and taking the file away are separate decisions. And every AI feature that reads deal documents goes through the same folder check as the file browser, in one shared retrieval path, so the assistant cannot put a document into an answer that the person asking is not cleared to read.

One thing belongs up front, because both of the matters below involve an advisory firm's own staff. Folder grades do not compartmentalise the advising firm's team. Deal team roles resolve to full access without consulting folder grants, so the folder model scopes the client and the counterparties rather than your own bankers and lawyers. What scopes them is a coarser layer, described further down.

Two matters in the news show why the reach of one account matters.

What the SEC alleges about how deal material was reached

The SEC announced charges on 6 May 2026 against 21 individuals over an alleged insider trading scheme. The complaint alleges that an M&A attorney misappropriated material nonpublic information belonging to his firm's clients, relating to more than twelve pending corporate transactions, and that it reached others who traded on it. The SEC puts the illicit profits in the millions of dollars, and parallel criminal charges were brought by the U.S. Attorney's Office for the District of Massachusetts.

These are allegations and nothing has been proven; the lead defendant has pleaded not guilty.

For anyone running a transaction, the route of access matters more than the trading. Reporting on the complaint has focused on the document management systems at the firms where he worked, including material for matters he was allegedly not staffed on. No system was broken into on that account; valid credentials reached confidential matters the holder had no role on.

What the FBI advisory says about attackers posing as IT support

FLASH-20260526-01, issued 26 May 2026, describes the Silent Ransom Group, also tracked as Luna Moth. The FBI says the group calls staff directly, or sends phishing emails designed to make the recipient call back, then poses as internal IT support and directs the employee to grant access to a remote desktop session.

The FBI states the group has consistently targeted US-based law firms since spring 2023 and has been active since at least 2022. The operation is data theft and extortion without encryption, and because the actors use legitimate remote administration tools, the advisory notes conventional antivirus is unlikely to flag it.

One detail matters most for access design. Once the actors are in, the FBI says, they minimally escalate privileges and pivot quickly to exfiltration. The attacker does not need to become an administrator, because the access the person on the phone already holds is usually enough.

Why both cases come down to the reach of one account

One is an alleged insider, the other an external group running a phone script, and they converge on one variable. The alleged insider conduct ran through valid credentials reaching matters the holder was allegedly not staffed on, and the FBI's attacker deliberately stays inside the compromised person's existing privileges. In both, the material at risk is set by how much one account could reach on an ordinary day.

The control is the same either way. Scope by matter rather than by firm, scope to the organisation as well as the person, and check the result before documents go in.

How access resolves to a deal, a folder and a party

Beneath the folder grades sits a coarser layer. A per-deal access grant decides whether an individual has read, write, delete or manage rights on that transaction at all, and that grant is the only thing that scopes your own deal team, since deal team roles bypass folder grades. Who is added to a deal is therefore the decision that governs internal reach, and a firm-level administrator account holds rights everywhere by design.

Within a deal, a per-user setting overrides a per-organisation setting, which overrides what the parent folder grants, which falls back to the organisation default. A folder scoped to one specific organisation is readable by that organisation alone rather than by every buyer. If no visibility is set anywhere up the tree, the folder resolves to internal, so a new folder is never bidder-visible by accident.

The room also knows which side you represent, so on a buy-side mandate it is the seller who is the counterparty, and the counterparty is kept out of the internal room by default. That is a default rather than a hard block: the deal team can still open one internal folder to the other side on purpose.

Download is enforced separately from reading. A view-only folder opens in the viewer, but its bytes are not exported through a file download, through the viewer's native stream, or inside a bulk ZIP, checked per file since a ZIP spans folders. Watermarks are applied when a file is served rather than stored, so the stored copy stays clean, and the mark carries the viewer's name, organisation and a UTC timestamp. A folder-level setting beats the organisation default in both directions.

A team member can also view the room as a specific counterparty organisation, with the permission engine resolving against that organisation rather than the interface hiding things. Views, downloads including via ZIP, permission changes and AI questions are recorded, with filtering and CSV export. See /security for detail.

Why the AI features cannot widen access

This part is not a setting, so it cannot be misconfigured. There is one retrieval function. It embeds the question, scores every stored document vector, then applies a folder-read check before a document may enter the answer at all, so the number of documents returned counts only documents the person may read. Chat and the drafting paths call it, and the separate search endpoint applies the same folder check.

Where a draft will be shown to the other side, scope tightens further. Grounding is restricted to documents that every counterparty organisation able to see that request list may read, an intersection rather than a union, resolved at the organisation baseline so a per-user grant cannot widen it. If it cannot positively confirm who owns the list, it denies rather than falling back to the banker's own access.

What a permission model does not solve

It does not compartmentalise your own firm, which is exactly the account type both matters above describe. Folder grades are resolved for client and counterparty organisations, and a deal team role is granted full access before any folder grant is consulted. The controls available for internal reach are the per-deal grant, which decides who is on the transaction at all, and the record of what each person did. Narrowing a staffed team member to part of a room is not something the folder model does.

It does not stop authorised access. Someone staffed on a matter can read that matter, and nothing here tells you a properly credentialed person is reading it for the wrong reason. That stays a supervision problem.

It does not authenticate. The FBI advisory describes someone talked into handing over a live session, after which the platform sees an authorised user doing authorised things. Session tokens are also not bound to a device or address, so a stolen one works from anywhere until it expires or is revoked. Single sign-on is available per workspace, using OpenID Connect with the authorization code flow and PKCE and a per-firm email-domain allowlist, which puts joiner and leaver policy in your identity provider; it is opt-in and does not replace the emailed one-time code. Scoping limits how much a compromised session reaches, but defending the phone call, the endpoint and the help desk is work at your firm.

The record has limits too. The access trail is an advisor oversight tool: the advisor's own users can read it, a buyer or seller cannot check their own activity. It records the actor and the source address, and it is not cryptographically tamper-evident, so treat it as an operational record, not an evidentiary one.

Watermarking has edges. The mark is applied at the moment a file is served, and it covers PDFs, Word files, images, spreadsheets and presentations; a file that cannot be marked is refused rather than served clean. But the mark is visible, not forensic. It shows who was served a copy, it does not survive a photograph or retyping, and the mark written into the header of an Office file can be stripped by a recipient willing to edit the file. Where that is unacceptable, view is the setting rather than watermark.

Defaults decide most of this in practice. Broad access is convenient during setup, and a room left on defaults has every control above available and none of it in effect. The grades only take effect once someone walks the tree and sets them.

One limit is worth stating plainly. AI retrieval admits any folder the person can read at all, including the view and watermark grades. A verbatim quote can therefore appear in an answer drawn from a document that person may view but not download. If that distinction matters, set that party's access to none rather than view.

None of this prevents a compromise. It limits how much material one account reaches when a compromise happens.