Ask Dockli is designed so that adding AI never widens your access, never leaks a secret to the client, and never sends the model more than it needs. This page is the detailed, IT- and security-team-facing account. For the broader product security model see Security architecture, and for the AI-specific control set see AI security.
The permission boundary
Ask Dockli operates strictly within your existing Microsoft 365 permissions. It can never see, open, or change anything you couldn’t yourself.
- Your delegated Microsoft Graph token is held only by Dockli’s local service on your machine — never by the interface, and never sent to the browser layer or to the AI. Every file search, read, move, send, or delete the assistant performs is executed by that service as you, through Microsoft Graph, subject to the same access checks as any other Microsoft 365 client.
- The interface talks to the local service over loopback (localhost), which is the trust boundary. AI requests carry no user token; the service attaches the Graph token server-side.
- Because the assistant is just another caller of your own Graph permissions, its reach is exactly your reach. Content stays inside your permission set — see Permissions and scopes.
The APIM entitlement gateway
The AI model is Azure OpenAI (gpt-4o), and Dockli reaches it through an Azure API Management (APIM) gateway rather than talking to OpenAI directly. This is what keeps the model key off your device.
- The Dockli client never holds the Azure OpenAI key. It calls only the APIM endpoint (
https://dockli-api-gateway.azure-api.net/dockli/chat/completions). - Each request carries two headers: an APIM subscription key (
Ocp-Apim-Subscription-Key) and a signed licence entitlement (X-Dockli-Entitlement). The entitlement is a short-lived token, issued by Dockli’s licensing service, that proves you hold a live, active seat. - APIM validates the entitlement first, then injects the real Azure OpenAI key server-side. The key is never present in — and cannot be extracted from — the client.
- The design is fail-closed: if the entitlement is missing or invalid, APIM rejects the call. Even a tampered client that somehow kept the subscription key still cannot use paid AI without a genuine seat, because the entitlement check happens before the key is ever applied.
Responses are streamed back token-by-token over Server-Sent Events, and the assistant runs a bounded tool-calling loop at a low temperature (0.2) for precise, repeatable behavior.
What is sent to the model — and what is not
Dockli sends the model only what it needs to answer, and no secrets.
Sent to the model:
- The Ask Dockli system prompt (its operating instructions).
- Your display name, appended so it can sign emails and address you correctly.
- When you use the folder-scoped panel, a short scope message naming the active folder, so the assistant confines its default actions to that folder.
- The extracted text of any documents you attach (text only — see below), delimited per file, each capped at roughly 48,000 characters and the whole attachment context capped at around 120,000 characters per turn.
- Your conversation turns — the visible user and assistant messages.
- The tool definitions the assistant can call, and the results of the tools it runs (for example, search hits).
Never sent to the model:
- The Azure OpenAI key (held only by the APIM gateway).
- Your Microsoft Graph token (held only by your local service).
- The Azure Speech key (held only by your local service).
- Raw Office file bytes. Dockli extracts text from your documents and sends only that — the original file is never uploaded to the model.
- Your licence or subscription secrets (the entitlement and subscription key are HTTP headers to APIM, not part of the model payload).
Text, not files
When you attach a document or Dockli reads one to answer you, only the extracted text goes to the model — never the file itself. Excel is read up to 2,000 rows, PDF up to 200 pages, and each file’s text is truncated to fit. See Attaching documents.
Not used to train foundation models
Ask Dockli runs on Azure OpenAI under enterprise data-handling terms: your prompts, your attached content and the model’s completions are not used to train the underlying foundation models. Your content is processed to answer your request and is not fed back into model training. For residency and retention specifics across Dockli, see Data handling and residency.
Attachment retention
Documents you attach are held transiently on your local Dockli service — never on Dockli’s servers:
- Only extracted text is retained (no file bytes).
- The attachment store keeps at most a small number of recent entries (on the order of 60) and expires each entry automatically after about 3 hours, whichever comes first.
- Removing a chip drops the attachment immediately.
Because the store is local and short-lived, attached content does not accumulate and is not synced anywhere.
The dictation token model
Voice dictation is built so your Azure Speech key never reaches the client:
- Your local Dockli service alone holds the Speech key.
- When you start dictation, the service mints a short-lived token (roughly a 10-minute lifetime) and returns only that token and the Azure region (eastus).
- Your microphone audio streams to Azure Speech using that temporary token, which expires on its own. The key stays server-side.
- The Dockli host auto-grants only the microphone permission — no other device permission is granted implicitly.
See Voice and dictation for the user-facing flow.
Chat history
Conversations are stored locally, per account, on your device — not uploaded to Dockli. See Chat history for how to review and delete them.
Where to go next
- AI security — the AI-specific control set
- Data handling and residency
- Security architecture
- Permissions and scopes