EVA only sees what the current user can see. Every query goes through the same permissions layer that gates the UI — no cross-department data leakage.
Any action with financial or operational impact (journal, invoice, salary change) is surfaced as a reviewable draft. Human approval is required to execute.
We log every interaction: who asked, what they asked, what EVA proposed, and who approved. Internal review and external audits become straightforward.