Learn more
about Curiosity

Two plans. The developer version is free for up to ten test users, with no time limit for development use. Enterprise Studio is priced for your deployment, on your own infrastructure, starting from fifty users. See Pricing.

Yes. The connector SDK brings custom sources such as a DMS, an ERP or a CRM system into the same graph as the built in connectors, with their records, relationships and permissions. See Extensibility.

Yes. The records and files you map are copied into Studio and kept in step by the connector. The source system stays the system of record, and each node links back to it.

Where a source has permissions, Curiosity syncs them, so a person only sees what the source system would show them. A change in the source reaches Curiosity with the next sync. For a source without permissions, such as an S3 bucket, you choose who may see it when you connect it. See Security.

In the browser, at an internal address you host, inside the environment your organization already has. Teams can also reach it from the command line, or through MCP from their own agents.

Yes. Point Studio at any endpoint that speaks the OpenAI API, or write a provider of your own in C# inside Studio for any other API. That covers most inference servers for open weights, the gateways platform teams run, and the cloud endpoints the major providers offer in your region.

Yes. OpenRouter is one of the providers built into Studio, so one key reaches every model it lists, and you can limit which upstream providers it routes to. Requests to OpenRouter leave your environment, so keep it to data that may go to a hosted model.

Yes. The model is a setting of the provider, so changing it is configuration. The graph, the permissions and the tools your teams built do not change with it.

Open weight models, run on your own servers: 15 in the list above, from OpenAI, Google, Mistral, Meta and Microsoft. Nothing is sent to a provider. Ask us which fit the hardware you plan to deploy on.

Yes. Run open weights with Ollama, or with any inference server that speaks the OpenAI API, on your own hardware. Studio calls it like any hosted provider.

No. Permissions are resolved at query time, before the model is called, so Studio's built in tools only hand the model records the person asking may see. Tools you write in C# get a query scoped to that user too: use it.

A Linux, macOS or Windows machine with Docker. The download is self contained, and the install script tells you if Docker is missing.

One Studio in Docker is one container to look after. The orchestrator is for many: one address, sleep and wake, updates, backups and usage for all of them, from one console.

Nothing. It stays on disk. Sleeping only stops the Studio, and updates never touch its data either.

No. Only a person opening it in the browser does. A forgotten browser tab does not keep a Studio awake.

Keep it warm, for up to 7 days or for good. If it stops for any reason, it is started again.

Yes. Use your own certificate, a self signed one, or Let’s Encrypt. To give each Studio its own subdomain, add a wildcard DNS record.

Yes. One orchestrator can manage others on more machines and serve every Studio from one address.

Yes. Set an API token and everything the console does, including backup and restore, is one HTTP call.

Open models in the GGUF format, from Hugging Face or from a file you copy in: families such as Llama, Mistral, Qwen and Granite, vision models and embedding models. The console marks a model it cannot run before you download it.

Spark places models on NVIDIA GPUs with CUDA 12 when it finds them, and runs them on the CPU otherwise, on x64 and ARM64.

A model answers one request at a time, in the order they arrive. Different models answer side by side.

The request log keeps prompts and answers for 30 days by default, so you can inspect them. Switch that off, or use a key with zero retention, and the content is never written to disk.

Studio takes any OpenAI compatible endpoint as its model, and Spark is one. Create a key in Spark’s console and add the endpoint and key to Studio.

Yes. Embedding models answer the OpenAI embeddings endpoint, for semantic search.

Run the install command again and restart Spark. Your models and settings are kept.

In the cloud, traffic runs over TLS 1.2 or later and your data is encrypted at rest with AES-256. On premises you hold the encryption key and the certificate. Access follows the permissions of your source systems, down to the record, and activity can be logged. The controls page lists every control.

An on premises deployment stores your data in your environment, and Curiosity holds none of it. A cloud deployment stores it in an isolated tenant in European data centers.

No. Customer data is never used to train shared or public AI models.

On premises, your records go only where you send them, and with a local model no AI provider sees them. Product usage, with each user's name and email address, goes to Mixpanel, and error reports go to Curiosity's own server until you switch them off. In the cloud, a language model sees the chats and referenced content a user sends it, temporarily and private to that user. OpenAI is the optional default, and you can choose another model. The subprocessors page lists everyone else.

Where you deploy. On premises it stays in your environment, and with an offline license it can run air gapped. Cloud deployments run on Hetzner, in Europe.

Cloud deployments use TLS 1.2 or later, and the graph and your files are encrypted at rest with AES-256. On premises you supply the encryption key and the certificate. Tokens and credentials are kept encrypted in secret management tools.

Only authorized Curiosity personnel can access production systems, and only when required. Internal roles follow least privilege and need to know.

Each customer’s data is kept in an isolated tenant. An on premises deployment is your own environment.

Cloud deployments are hosted with providers certified to standards such as ISO 27001 and SOC 2. The Security and Compliance Overview sets out the full posture. Download it from the resources page.

Yes. Curiosity is a German company and GDPR compliant, and a DPA is available. The Data Protection and Processor Policy is available on request.

It is set out in the Incident Response and Breach Policy. Request it from the resources page.

Single sign on works with Google, Microsoft, Okta, Auth0 and SAML2, with MFA enforced in your identity provider. Access is relationship based, for teams, workspaces and user roles, and synced from your source systems. Ask us about provisioning for your directory.

Yes. User actions, downloads, exports and AI interactions can be logged. Admins can restrict features per user, and models, data sources and tools per workspace.

Yes. Studio runs as a container on your servers or in your private cloud, and on Windows. Your data stays in your environment, and with an offline license the deployment can run fully air gapped.

On premises, one: Mixpanel, for product usage analytics. Cloud deployments use five. Both lists are on the subprocessors page. The authoritative register is a document, available on request.

Yes. Use a bundled local model, a hosted provider, an OpenAI compatible endpoint, or vectors you compute yourself. A different model means a new embedding index, and the graph is not touched.

Connectors write each record's access as team and user restrictions, and Studio checks them on every query, down to node types and fields. A revoked access applies on the next query after the connector syncs it, with no reindex.

Yes. Curiosity.Library gives you the graph and its queries from C# or Python, and you publish your own REST endpoints in C# inside Studio. Studio also serves an MCP server and an OpenAI compatible chat API.

No. It is a typed property graph stored in RocksDB, with nodes and their edges kept in memory for traversal, and full text and vector indexes in the same process. There is no RDF or SPARQL layer.

No. Studio keeps a synced copy of the records it needs and links back to each source. Your systems keep their role, their validation and their audit trail.

Deployments run over 30TB of connected data in production.

Yes. Add pattern spotters, spotters learned from nodes already in the graph, and trained entity models. In C# you can post-process each entity type, or write a code index that runs on every change to a node type.

Only when you ask for one. Tokenizing, entity spotting and linking run locally without a model. From code, StructuredAI classifies and scores text with a local model by default, or with an LLM provider you name.

When your connector syncs the change, the node is updated in place by its key and queued for every index, so parsing, embeddings and entity links catch up without a full rebuild.

Studio ships Harrier, Arctic XS and MiniLM, which run in process with no network. You can also call OpenAI, Azure OpenAI, Anthropic, Cohere, Google or any OpenAI compatible endpoint, or store vectors you compute yourself.

Yes. From code you can query the vector index directly, by text or by vector. In search, vector hits are added to keyword results or rerank them, each above a similarity cutoff you set, so exact part numbers still match.

A model is fixed per embedding index, so you create a new index with the new model and it embeds the field from the start. The graph, its nodes and your code are not touched.

Not through the built in tools: they search and read as the user who asked. Your own tool code gets both an unrestricted query and one scoped to the current user. Use the scoped one, and limit who may call a tool with its access groups.

Every agent run is stored as a record: the prompts, each tool call with its arguments, its result and how long it took, and the calls of any agent it handed work to. A wrong answer is a thing you can read rather than guess at.

They can call tools you register, including ones that write. What those tools permit is your decision.

No. Without a license key Studio runs with every feature on, for up to ten test users, with no time limit for development use.

No, and on purpose. The UI talks to its own session API. Your code uses the Library API with a token you can revoke, or the REST endpoints you write in C# inside Studio.

Yes. Studio commits every configuration change to a git repository and can push it to your remote. Schemas, endpoints, AI tools, agents and tasks are files you can review, and you import them back as a bundle or from the command line.

C#, for endpoints, AI tools, scheduled tasks, code indexes and connectors, with the same types Studio uses. Connectors can also be written in Python.

Extensions are kept as source and compiled by Studio, so an upgrade compiles them against the new version and a break shows as a compile error, not a silent failure. Stay on the documented surface (Graph, ChatAI, AgentAI) and it holds.

Yes. Push your own front end, written in C#, to Studio over git. It compiles each commit to a preview, and you promote the one you want to live.

Every result is checked against the user's teams and restrictions when the query runs, down to node types and fields. What those restrictions are depends on what your connector syncs from the source.

Wherever you deploy. Search, embeddings, entity extraction and OCR run inside Studio, and with a local model nothing goes to an AI provider. You can switch off the usage counts and error reports that go to Curiosity. The front end reports product usage to Mixpanel.

Yes. Admins choose which actions are logged, then filter and download the trail. The log files carry a hash chain you can verify from the command line, which also converts them to CSV or JSON for your own retention.

OCR turns a picture of text into text. Intelligent document processing uses OCR as its first step on scans. Then it finds the layout, sorts the document by type and reads out named fields, each with a confidence. A born digital PDF needs no OCR at all.

Yes, for the values the system is unsure of. A confidence per field decides what goes straight through and what a person checks against the page. Set the bar by what a wrong value costs, and use the corrections to test the next change.

It can. In Curiosity Studio, extraction and OCR run inside Studio, on your infrastructure. So do spotters, pattern spotters and extraction with a model you host. A hosted model, such as Cloudflare’s Clairic, sends its input to the vendor, so choose it field by field.

A knowledge base holds articles people wrote and keep up. AI knowledge management also reads the records knowledge sits in, such as tickets, field reports and email, and answers from them with each source cited. It still needs a way to write new answers down.

Give records a status the system can read, mark superseded revisions with what replaced them, and let people flag an answer when they use it. Then test with questions about things that changed, and check which revision each answer cites.

No. It finds what they already wrote down and makes it easier to write down more. Tacit knowledge, learned by experience, still lives with people. A good system shows who wrote a record, so a reader knows whom to ask.

It can be ordered to. Under the US CLOUD Act, a provider under US jurisdiction must disclose data in its possession, custody or control when ordered, wherever it is stored. The European Data Protection Board found that this can put such a provider in conflict with the GDPR.

The scoring the European Commission built to buy sovereign cloud for the EU institutions. It rates a provider on eight objectives, from legal and operational to supply chain and technology, with assurance levels from SEAL-0 to SEAL-4. The Commission welcomes any organization that wants to use it.

Yes. Its switching rules cover a move to another provider or to your own infrastructure. The contract has to set a notice period of at most two months and a transition of at most 30 days. From 12 January 2027, a provider may not charge for switching.

Your records go only where you send them, and with a local model no AI provider sees them. Usage and error reports go to Curiosity until you switch them off. The front end reports product usage to Mixpanel, on EU servers, with each user’s name and email, and has no setting to stop that.

It can write one. Whether it should run on its own depends on what the app stands on. If the app already has its data, sign in and hosting, or reads one system, the agent alone is enough. If it needs records from several systems, access per record and an audit trail, build it on a platform that holds those.

Below the code, in the platform the app reads through. A check written into each endpoint holds only where the agent remembered it. In Curiosity Studio, access is synced from the source systems and checked per record on every read. Code built on it inherits what each user may see.

From documentation it reads while it works, not from memory. Through curio, an agent reads Sudo’s skills and the API reference of the Studio version you run. Its change is compiled against the workspace before it is staged.

Not by default. curio signs in without the approve right unless you choose otherwise. The agent stages a commit, and a person approves the diff on Sudo’s review screen.

A system prompt is loaded in full on every turn. A skill costs a name and a one line description until a task needs it, and its body is read only then. Put what must hold for the whole conversation in the system prompt, and how a task is done in a skill.

The format does. A skill is a folder with a SKILL.md file, defined by the open Agent Skills specification. Claude Code, OpenAI Codex, GitHub Copilot and others read it. What differs is the folder each agent looks in, and the extra fields some agents add.

Only after reading all of it. A skill can carry scripts and instructions to call tools. A malicious one can make an agent run code or send data where it should not. Treat it like software: install from sources you trust, and check what its scripts can reach.

Write the skill under Manage, AI, Skills, then pick it in the Skills list of the assistant editor. Every chat started from that assistant carries it. The model sees each skill’s name and description, and reads a body only when it needs it.

A single-tenant deployment serves one customer or team, with its own app and data. A multi-tenant platform serves many and keeps them apart, by sharing some layers and separating others. A platform can also run a single-tenant instance per tenant behind one address.

It can be, if every query runs through it. OWASP’s cheat sheet names the gaps. Some database roles bypass the policy, and a reused connection can carry the last request’s tenant. Caches, files and logs sit outside the database altogether. Test each path.

A model that only answers, and is never trained or tuned on tenant data, does not learn any tenant’s records. A model tuned on one tenant’s records and served to another can repeat them. Shared prompt caches on a model server can also reveal what others asked, through response times.

Yes. Curiosity Orchestrator runs a Studio for each team, project or customer on your own servers, behind one address. Each keeps its own data, users and settings, and sleeps when nobody uses it.

No. A percentage is a share of a known whole, and a score has none: no value means a perfect match. It puts results in order for one query. A bar drawn against the best result is full at the top of every list.

No. A score depends on the query’s words and on the rest of the index, so each search has its own scale. Compare results within one list, by their order and the gaps between them.

There is no such value. A keyword score has no fixed top, and the same number means different things in different searches. Judge a result by reading it, and judge a ranking against queries people have marked.

Because the bar is drawn against the best score in that list. The best result fills it whether it matches well or poorly. Read the gaps between the bars instead.

Security keeps attackers and unauthorized people out. Governance decides who inside the company may build, approve, ship and change an AI tool, and keeps the record. A governed tool still needs security, and a secure tool can still be ungoverned.

Being internal does not decide it: the Act classifies a system by its use. Annex III lists uses such as filtering job applications and evaluating staff, so an internal HR tool can be high-risk. Check each tool’s use against the Annex with your counsel.

A named administrator who did not build it and who answers for the system it changes. In Curiosity Studio, Sudo stages each change and an administrator approves or discards it. For an administrator who may only read, Sudo drafts the change and cannot stage it.

Less when the controls live in the platform. Permissions, logging, model choice and hosting are decided once, and every tool inherits them. What is left for each tool is one review of one change.

Prompt engineering is writing the instruction. Context engineering decides everything the model reads on each call: instructions, tool definitions, retrieved records, tool results, memory and history. It matters most for agents, whose context changes with every turn.

A bigger window raises the limit, not the quality. Studies such as Chroma’s 2025 report found models less reliable as the input grows, even on simple tasks. A small window holding the right records usually beats a large one holding everything.

The loss of accuracy as a model’s context grows: the more tokens in the window, the worse the model recalls and uses what is in it. Anthropic uses the term, and Chroma measured the effect across 18 models in July 2025.

Clearing what a long run no longer needs, such as old tool results, and replacing the history with a summary when the context window is nearly full. The agent then continues with the summary and its latest results.

A program that offers tools, resources and prompts to AI applications over the Model Context Protocol. It can run on the same machine as the application or remotely over HTTP. An application connects to it, lists what it offers and calls its tools.

Function calling is how a model asks its own application to run a tool. MCP is how that application finds tools on other systems and calls them there, in one format any MCP server understands. The two work together.

Partly. For remote servers the specification defines an OAuth 2.1 flow, and it is optional. It says who connected. Which tools that person is offered, which calls run and which records come back are decided by the host, the server and each tool.

Yes, as a server. A Studio workspace can host its AI tools over MCP, so external MCP clients can discover and call them. Its built in read tool reads only what the calling user can see. To bring another system’s data into Studio, you use a connector.

No. An MCP server offers tools, resources and prompts, and runs a tool when a host calls it. Deciding which tool to call, and what to do with the result, is the model’s job in the host. A server may call a model inside one of its tools, but to the host that is still a single tool call.

No. Every major model API takes tool definitions directly, and your application runs the calls. MCP helps when the same tools should serve several AI applications, because it standardizes how they are listed and called.

Yes. Studio serves its AI tools over MCP, so an outside MCP client can list and call them. The client uses an MCP token minted under Manage → Access → Tokens. The token acts as one user, so the client sees only the tools that user may call.

A tool is a C# function the model can call to do something: search, read or write. A skill is a short Markdown document the model reads when it needs to know how a task is done. A tool changes what the model can do, a skill what it knows.

Deduplication is one case of it: finding records that describe the same thing within one list. Entity resolution also matches records across systems that use different keys, names and formats, and keeps a link from the resolved entity to each source record.

Rarely. A part number one character away is usually a different part or revision, not a typo. Standardize identifiers first, such as case and separators, and then match them exactly. Keep fuzzy matching for names, addresses and descriptions.

When code merges two nodes as aliases, the edges of the merged node move to the node you keep and the merged node is deleted. Its key, or another field you name, stays on the kept node as a searchable alias, so a search for the old id still finds it.

A person. The usual design has two cutoffs: pairs above the upper one are merged, pairs below the lower one stay apart, and the pairs between them are held for review. Moving the cutoffs apart lets fewer errors through and sends more pairs to review.

Not entirely. Roles still fit coarse questions, such as who may administer a system. ReBAC handles which records a person may open. A role can also be modeled as one more relationship, and a condition such as the time of day can sit on top of a relationship check.

The authorization system Google described in a 2019 USENIX paper. It stores permissions as relation tuples, such as a user being a viewer of a document, and answers checks for services including Calendar, Cloud, Drive, Maps, Photos and YouTube.

Yes. A team can be a member of another team, to any depth. Whatever a parent team owns is visible to the members of every team nested inside it, and nothing flows sideways between sibling teams. Nested teams are created from code, for example by a connector mirroring the source system’s groups.

In Curiosity Studio, the Access Debugger takes a user and a node and draws the chain that carries the access: the ownership edges, the teams they lead to, and the user’s membership in them. A chain that stops short shows where.

Not quite. A platform can offer several models and still write its tools against one vendor’s API, so a change means rewriting them. Model agnostic means the tools talk to one interface, and the model behind it is configuration.

It settles the format of a request, not how the model behaves. Compatible endpoints often support a subset of the API and ignore the rest. Prompts and tool calls still need testing on the new model before people rely on it.

On a model agnostic platform, yes. In Curiosity Studio an administrator switches on the models each provider may use, and a chat or an agent can run on a specific model instead of the provider’s default.

It should not. In Curiosity Studio access is checked per record before the model is called, so any model only receives the records the person asking may open.

No. It moves the lock-in into your own code, and onto the team that has to run it: the connectors, the permissions and the upgrades. That can be the right choice. It is still lock-in, counted in your own team’s time.

Usually the data and the logic. A model can be changed and tested again. Records joined across systems, access rules and tools written in a vendor’s editor have to be moved or rebuilt.

During the evaluation, before you sign. Ask where each layer lives, then test two of them on the pilot: export what it built, and change the model.

Your source systems stay the systems of record. Connectors copy what they map into the graph and link each record back to its source, so nothing was moved out of those systems. Studio can also commit its configuration to your own git repository.

On premises says where the servers stand: in your building. Air gapped says what the network connects to: nothing outside it. An on premises system can still call a hosted model and download its updates from the internet. An air gapped one cannot.

No, only harder to reach. ESET studied 17 known malicious frameworks built for air gapped networks, and all of them crossed the gap on USB drives. The import path needs its own checks, on both sides.

By hand. A release is downloaded on a connected machine and its checksum and signature are checked. It is then carried across on approved media and checked again at an import station inside. Then it goes into the internal registry or the model folder.

An offline license, a local model, and usage and error reporting switched off. The container image is mirrored into your own registry, and the graph is encrypted at rest under a key you set.

Open weights means anyone can download the trained model and run it. Open source usually also means the code, and sometimes the training data, are published under an open license. Many open weight models publish the weights alone, under a license that may limit how you use them.

It names the quantization: a 4 bit K-quant, one of the quantization types llama.cpp defines. In llama.cpp’s table for Llama 3.1 8B it comes to 4.89 bits per weight, and the model to 4.58 GiB.

The weights, plus the KV cache for each conversation, plus working buffers. The weights are the parameter count times the bits per weight. Llama 3.1 8B is 4.9 GB at Q4_K_M in llama.cpp’s table. The cache grows with the context length and with every conversation served at once.

Somewhat, and how much depends on the model and the quantization. Measures such as perplexity show how far a quantized model drifts from the original. Run your own questions against two or three quantizations and compare the answers before you choose.

No. A graph database is the storage and query engine. A knowledge graph is the data in it, organized by a schema around the entities a business cares about. It can live in a graph database, in RDF triples, or in the typed graph Curiosity Studio keeps.

Not to start. A schema that names your types, their keys and the relationships allowed between them answers most questions a business asks of its records. A formal ontology earns its cost when you need to reason over classes or share definitions with other organizations.

No. Search finds a place to start, by words or by meaning. The graph walks from there to the records connected to it. Curiosity Studio runs both on the same records, in one system, under the same permission checks.

A stable key for each record, the fields worth keeping and who may read it. It also needs the links the record already holds, such as a part number on a ticket. With those, a connector can load the record, link it and keep its permissions.

No, though it contains one. A knowledge graph models entities and how they relate. A context graph adds what was decided about them, when and by whom, and who may see each part. A person or an agent can then act on it.

A record of one decision: what was decided, by whom, when, under which rule or exception, about which records, and what precedent it cited. The term comes from Foundation Capital’s December 2025 essay on context graphs.

Where a decision is written down. Each agent run is stored with its transcript, and each change Sudo stages records the administrator who approved it. Decisions recorded in a connected system arrive as records. Studio does not rebuild decisions nobody recorded.

Federated search sends one query to several systems at once and combines what each one returns. Enterprise search usually gathers every source into one index and ranks the results together. Curiosity Studio brings connected systems into one graph and checks access per record at query time.

It should not. Two things cause it: files shared too widely in the source system, and access rules an index copied and has not updated. In Curiosity Studio access is checked per record at query time, and a revoked access applies on the next query after the connector syncs it.

With a judged set of real queries. People who know the records mark the right answers, and you measure the ranking before and after each change. Add tests that run the same queries as users with different access, and searches for exact identifiers.

No. Search finds and ranks records. An assistant or agent uses search as a tool, often several times for one question, and writes an answer from what it found. It is only as reliable as the search under it, and only as safe as that search’s permission check.

It is when people both name things and describe them, which is common in industrial records. Vector search alone misses exact identifiers such as part numbers, and keyword search alone misses paraphrases. Measure both and the merged list on your own judged queries before you decide.

A way to merge ranked lists using only the ranks. Each record gets 1 / (k + rank) from every list it appears in, and the sums decide the order. Cormack, Clarke and Büttcher introduced it in 2009 with k fixed at 60.

Two part numbers that differ by one character read almost the same to a language model, so their vectors sit close together. For an identifier, close is the failure: 2741-08 and 2741-09 are different parts. Match identifiers exactly with keyword search.

Not in Curiosity Studio. The vectors are stored beside the records in the graph. There is no second store to keep in sync, and no second set of permissions to maintain.

It is one way to build one. A container gives the code its own view of files and network, but it runs on the host’s kernel. gVisor and microVMs put another wall between the code and that kernel. Whichever you use, also limit the network, the time and what the code can write back.

Without it, anything the code read can leave, and a steered agent can send your data to whoever steered it. Block the network entirely, or allow only hosts you name, enforced from outside the sandbox.

No. The sandbox ships no network commands: curl, wget, ssh and git are absent rather than refused. One exception is off until an administrator turns it on: a headless browser that reaches only the hosts they allow.

A sandbox you build as an AI tool gets 60 s and 256 KB of output per script by default, and 300 s and 4 MB at most. It has no process and no disk, only the mounts you define, and no network unless you name a host for the browser.

A chatbot answers each message from what it was given. An agent works on a task in steps: it plans, calls tools such as search, reads the results and decides what to do next. It stops when it can answer or when a limit stops it.

In a workflow, code a person wrote fixes the steps and the model fills in parts of them. In an agent, the model chooses the steps and the tools. A workflow is easier to test, and an agent handles questions nobody scripted.

Those of the person it runs for. The built in tools search and read as that person, so an agent cannot open a record through them that the person could not open. In your own tools, use the query scoped to the current user.

As few as the task needs. Overlapping tools leave the model unsure which one to call, and the Curiosity documentation suggests fewer than about 10 per agent. Each tool is also one more thing the agent can reach.

No. Filtering the answer runs after the model has read the records, so a restricted record can still shape what it wrote. Permission-aware retrieval runs the check when records are fetched, so a record the person may not open never reaches the model.

Not by itself. It enforces the permissions the source systems hold, including ones that are too broad. A folder shared with everyone stays shared with everyone, and an assistant finds it faster than a person browsing. Review the widest permissions in a source before connecting it.

In Curiosity Studio a record’s permissions are written by its connector, so a change arrives with the connector’s next run. Team memberships from your identity provider refresh when the person next signs in. For an immediate revocation, also remove the user in Studio.

In Curiosity Studio, yes. Node types, individual fields, code endpoints, AI tools and AI assistants can each be restricted to access groups. The check runs when the query runs.

A jailbreak is a user talking a model into ignoring its maker’s rules. Prompt injection is text from someone else, often hidden in content the model reads, steering an application against its own user. OWASP counts jailbreaking as a form of prompt injection; Simon Willison, who coined the term, keeps them apart.

Not reliably today. OWASP’s guidance says it is unclear whether any method prevents it fully, and detection filters miss some attacks. Design so that a steered model can reach little: the asker’s permissions, no way out for data, and a person approving every change.

Instructions hidden in content a model reads rather than in what the user typed: an email, a web page, a document or a ticket comment. The attacker never talks to the assistant. Their text reaches it when the assistant searches or summarizes that content.

It can steer what Sudo drafts, which is why nothing he drafts applies by itself. His edits stay in his own copy, in a sandbox with no network. A commit only stages them, and an administrator reads the diff before anything applies.

No. Data residency says where records are stored. Sovereign AI also covers where the model runs, who operates the machines, which law they answer to and who can switch the system off. A system can keep its data in the EU and still send every prompt elsewhere.

No. It means the choice is yours, and you know what each choice sends where. In Curiosity Studio the model is a setting. Use a hosted provider for some work, and open weights on your own servers for records that must stay in the building.

Yes. Article 2 covers deployers located in the EU, and providers who place AI on the EU market wherever they are established. Which obligations apply depends on what the system is used for, not on where it runs.

Yes, if every part of it runs inside: the data, the model, the compute and the license. Curiosity Studio supports air gapped deployments, with an offline license, local models and usage reporting switched off.

In the loop, a person takes part in each decision before it takes effect. On the loop, the system acts on its own while a person monitors it and can step in. Changes to running systems need the first.

Article 14 requires human oversight of high-risk AI systems: people who can understand, monitor, override and stop them. It does not prescribe an approval for each change. Outside the high-risk categories, approval is a design choice.

Less than approving every step. An assistant that works in a sandbox can act freely there and ask once, for the finished change. Sudo in Curiosity Studio works that way: one review of one diff.

It should not be able to. In Curiosity Studio, Sudo can stage a commit but cannot apply it. An administrator approves it. For an administrator who may only read, Sudo drafts the change and cannot stage it.

In NVIDIA’s use of the term, yes: a data center built for AI work, whose product is model output measured in tokens. In the enterprise sense, the factory is the line that turns requests into internal software. It runs on that infrastructure, or on hosted models.

No. In Curiosity Studio the model is a setting: 19 providers are built in, hosted ones among them. When you want the models in house too, open weights run on your own servers, and Spark serves them on your own GPUs.

A tool one team uses for one workflow and pays for per seat, whose data already lives in systems you run. It proves the foundation: the connectors and access groups it sets up are what the second tool reuses.

A person. In Curiosity Studio, Sudo and coding agents working through curio stage each change as a diff in a sandbox. Nothing is applied until an administrator approves it.