- Score an AI brain tool on seven criteria: permission-aware retrieval, source provenance, audit trail, integrations, deployment and residency, model flexibility, and pricing model.
- Permission-aware retrieval is a gate, not a criterion. Everything else is worthless without it, because the tool will faithfully surface whatever your source systems already overshare.
- Ask whether retrieval is filtered before the model reads, or whether the answer is filtered after. Only the first is a security property.
- Bring-your-own-key changes who the model provider's no-training promise is made to: you, directly, rather than to your vendor.
- A vendor who will not publish a price is telling you something about the sales process you are about to enter, not about the product's quality.
Choose an AI brain tool on seven criteria: whether retrieval respects each user's permissions, whether answers cite their sources, whether access is auditable, which systems it connects to, where the data is deployed and stored, whether you can bring your own model key, and whether the price is published. The first one is a gate: fail it and the rest do not matter.
1. Does retrieval respect each person's permissions?
This is the gate. Ask whether the retrieval step is scoped to the asker before the model sees any document, or whether the model reads everything and the answer is filtered afterwards. Only the first is a security property. The second is a content filter wearing a security badge, and it fails the moment the model is asked to summarize rather than quote.
The question to ask a vendor: when user A asks something, does the retrieval index ever return a document user A cannot open? A good answer is no, never, and here is the enforcement point. A bad answer explains post-processing. AI access governance is the longer version of why this distinction is load-bearing.
2. Does the answer cite its sources?
An answer without a citation cannot be checked. Require that every claim in a generated answer links back to the document it came from, and that clicking through respects permissions too. Provenance is what converts an AI answer from a plausible sentence into something an employee can act on and a reviewer can trace.
The red flag is a tool that cites confidently and links to a document the reader cannot actually open. That is a permission leak disclosed by the citation UI, and it means retrieval and access control disagree with each other.
3. Can an administrator audit what the AI retrieved?
Require an audit trail that records who asked, what was retrieved, and under which access rule, and ask specifically how long it is retained and whether it can be edited. An administrator who can quietly rewrite the log is the one person the log exists to constrain.
The numbers argue for asking early. In IBM's Cost of a Data Breach Report 2025, 13% of organizations reported a breach of an AI model or application, and 97% of those lacked proper AI access controls. The audit trail is how you find out which group you are in before somebody else tells you. What makes an AI brain secure covers the enforcement side.
4. Does it connect to the systems you already use?
Connectors decide whether the brain reflects reality or a snapshot of it. Ask which systems are supported, how often they sync, and critically, whether each source's permissions travel with its content. A connector that ingests documents and drops their access-control lists has converted a governed system into an ungoverned one, silently.
Ask also what happens when a permission changes at the source. If a file is un-shared in Google Drive at nine in the morning, when does the brain stop retrieving it? A straight answer is a propagation window in seconds. AIVM Brain propagates access changes in near-real-time, about sixty seconds.
5. Where does the data live, and where does it run?
Establish two things: where documents are stored at rest, and where inference happens. These are different questions with different answers, and a vendor can be entirely correct about the first while your prompts travel somewhere you did not expect for the second. Ask both, separately, and get the answer in writing.
Deployment options genuinely differ. Glean offers to "run Glean in a fully isolated, single-tenant environment," Glean-hosted or in your own cloud. Onyx is MIT-licensed and self-hostable. AIVM Brain is hosted only, with per-tenant Postgres isolation rather than a regional or on-premises option, and if regional residency is a hard requirement for you then a self-hosted tool is the better choice.
6. Can you bring your own model key?
Bring-your-own-key matters for a reason most buyers miss: it changes who the model provider's data commitment is made to. With your own key, Anthropic's or AWS's no-training terms bind directly to you. Without it, you are relying on your vendor's contract with the provider, and on your vendor's word about what it forwards.
The commitments themselves are now unambiguous and worth reading. Anthropic commits in its commercial terms: "Anthropic may not train models on Customer Content from Services." The Amazon Bedrock FAQ is equally direct, promising that "your content is not used to improve the base models and is not shared with any model providers." Glean, Onyx, and AIVM Brain support customer-supplied keys; Microsoft 365 Copilot and Notion AI do not for their core products.
7. Is the pricing published?
A published price is a statement that the product can be evaluated without a salesperson, and it is a proxy for how the rest of the relationship will go. Microsoft lists Copilot at $30.00 per user per month paid yearly. Notion lists Business at $20 per member. Glean's pricing page, as of July 2026, offers only a demo request.
None of this makes a sales-gated tool a bad tool; Glean is excellent. It does mean your evaluation timeline is now partly outside your control. The ranked comparison lives in the best AI brain tools compared, and the full roster is at compare AIVM Brain to alternatives. Our own tiers are all listed publicly, which is the standard we would want applied to us. AIVM Brain comes out of AIVM.