Tool classification

Tools are classified like models, and the platform blocks a tool whose classification sits below the Space using it. Because a tool can send part of a conversation outside Intric, this is a decision about data flow rather than convenience.

Kinds of tool

• Built-in tools — ready-made capabilities such as web search, built directly into Intric.
• Integrations — connections to services your organization already uses, such as SharePoint or Google Workspace.
• Custom tools (MCP) — connections your organization builds itself, using the Model Context Protocol.

Enforcing matching classification

By default, a tool follows the same inheritance rule as models: a tool classified Confidential, say, is also available in Spaces classified Sensitive or Open, because a classification is a ceiling on trust, not a fixed lane — anything approved at a high level is safe at every level below it too.

Enforce matching classification turns that inheritance off for one tool. Once enabled, the tool is only available in Spaces whose classification matches its own exactly — not higher, not lower.

Why restrict a tool this way

Inheritance makes sense for a model: a model trustworthy enough for Confidential data is trustworthy enough for anything less sensitive too. A tool is different, because using it means sending a live query to an external sub-processor every time — the classification is less about how much the tool can be trusted and more about which specific data-sharing arrangement it belongs to.

A SharePoint integration classified EU, for instance, is only appropriate for the exact SharePoint sites and data agreements it was configured for. Left to inherit downward, it would also show up in every Open Space in the organization — technically permitted, but not what the integration was actually approved for. Enforcing matching classification confines it to the Spaces it was set up for, instead of leaving it broadly reachable by virtue of being “safe enough.”

What is actually sent to a tool

When a built-in tool like web search runs, the model generates a query and sends it to the relevant sub-processor. Your original prompt, chat history, attached files and personal data aren’t sent along with it. The generated query itself, though, can still reflect sensitive context from the conversation, which is exactly why a tool still needs an appropriate classification rather than being treated as universally safe.