Awardco Intelligence — MCP and AI Security Overview

1. Awardco Intelligence summary

Awardco Intelligence brings AI-powered capabilities to the Awardco platform through two related surfaces:

• In-App Chatbot: a conversational assistant inside the Awardco platform that can answer questions about recognition, engagement, and programme data and perform a limited set of actions on a user’s behalf.
• MCP Server: a remote Model Context Protocol server that allows approved external AI clients to work with Awardco data and functionality.

Both surfaces use the same tool framework and the same identity and authorisation model. Awardco Intelligence does not introduce a separate entitlement system. Each interaction is performed for a specific authenticated Awardco user and is constrained by the permissions that user already holds in Awardco.

Awardco Intelligence is designed to follow the data-handling, storage, privacy, and security practices of the Awardco platform. Personal data is processed as described in Awardco’s Privacy Policy and applicable customer agreements.

This overview covers the In-App Chatbot and the MCP Server, which exposes Awardco data to approved external AI clients. It does not address MCP Connectors, a separate, opposite-direction capability that lets the In-App Chatbot draw context from a user's connected Slack or Atlassian account.

2. Access and availability

Awardco Intelligence is opt-in and disabled by default. A customer environment is not enabled without an explicit decision to activate the capability.

Access is controlled at the company level and at the individual-user level:

• Company-level enablement controls whether Awardco Intelligence is available to the customer environment.
• Each user must separately authorise an external AI client before that client can access the user’s Awardco data through MCP.
• Users can revoke their own external AI client connections through the Awardco Connected Apps experience.
• Disabling Awardco Intelligence for a company revokes that company’s existing external AI client connections in bulk.
• Awardco can disable the capability platform-wide as a global rollback mechanism.

Customer-admin controls and self-service enablement will be available in a later release.

3. Identity and authorisation model

3.1 Governing principle

Awardco Intelligence creates no new entitlements.

An AI surface can only do what the requesting user can already do in the Awardco platform. There is no elevated AI identity, service-account permission bypass, or separate AI-only access model.

If a user cannot view a report or perform an action in Awardco, an AI assistant cannot retrieve that report or perform that action for the user.

3.2 Authentication

Identity is established through Awardco’s existing platform login. An organisation’s configured SSO, password policy, multifactor authentication, and session-timeout settings continue to govern authentication.

Awardco Intelligence does not collect or handle end-user passwords or other end-user credentials.

3.3 Authorisation enforcement

After authentication, Awardco resolves the request into a user context containing the user’s identity, company, role, and data-access scope. That context is evaluated against the user’s actual Awardco permissions before a tool can run.

Authorisation is enforced at tool discovery as well as tool execution:

• Each tool declares the Awardco permission it requires.
• If the user lacks that permission, the tool is not returned in the available-tool list and is not presented to the AI model.
• Tool execution performs authorisation checks again using the authenticated user context.
• Reporting and analytics tools use the same permission service that governs equivalent reports in the Awardco user interface.
• Recognition visibility respects the applicable public and private recognition settings.

This design limits the impact of an incorrect or malicious model instruction because the model cannot invoke capabilities that are not available to the authenticated user.

3.4 Tenant isolation

Company identity is carried in the authenticated request context and enforced during tool execution. Requests are restricted to the authenticated user’s company and data-access scope.

Cross-tenant access is treated as a release-blocking security condition and is covered by dedicated testing, including testing of regional data boundaries.

4. In-App Chatbot

The In-App Chatbot operates inside an authenticated Awardco platform session. It is available only when the customer-level capability is enabled and the user has access to the relevant Awardco experience.

The chatbot receives:

• The user’s messages.
• System context needed to operate the assistant.
• Results from tools the user is authorised to invoke.

Tool results are capped by a per-company maximum row count. The current draft records a default maximum of 50 rows, with truncation logged.

Conversation history is stored in Awardco’s regional Azure database, scoped to the individual User ID, and retained for 90 days, unless otherwise requested by the customer.

5. MCP Server

The MCP Server is a remote service that external AI clients connect to over HTTPS. An enterprise administrator configures the Awardco MCP Server URL in the customer’s selected AI platform.

The MCP Server does not rely on an Awardco browser session cookie. Instead, the external client obtains an OAuth 2.0 access token after the user authenticates through Awardco and provides consent.

5.1 External-client authorisation flow

The high-level flow is:

1. The external AI client requests access to the Awardco MCP resource.
2. Awardco returns an authorisation challenge and the appropriate authorisation information.
3. The user authenticates through the standard Awardco login experience.
4. The user reviews the requesting client and requested access, then provides explicit consent.
5. The client exchanges the authorisation code for an access token.
6. The client calls the MCP Server with the access token.
7. Awardco validates the token and resolves the request to the authorised Awardco user and company.
8. Awardco resolves platform permissions and exposes only the tools available to that user.
9. The tool executes using the user-scoped authorisation context.

Awardco publishes standard discovery metadata so compatible clients can locate the authorisation server and protected resource information automatically.

5.2 Client registration

Awardco supports two constrained registration paths:

• Pre-registered clients: known enterprise AI platforms may be registered by Awardco, while still requiring explicit user consent.
• Dynamic Client Registration is limited to locally installed AI clients using approved redirect-URI patterns. Arbitrary HTTPS redirect URIs are not permitted. Users must still explicitly authorise each client connection, and Awardco may revoke registrations or connections when necessary.

At General Availability, company administrators will be able to enable or disable the In-App Chatbot and MCP Server for their users. Supported external AI clients at General Availability will include Claude, Glean, and Microsoft Copilot 365.

5.3 Consent and revocation

Consent is granted per user and per client. Before access is issued, the user sees the requesting application and the requested access and must explicitly approve the connection. Awardco does not publish granular OAuth scope names externally. Access is enforced through the connected user’s Awardco role, company permissions, and user-level permissions.

Consent state is held temporarily while the authorisation flow is completed. Users can revoke connections through Connected Apps, and company-level disablement revokes the company’s connections in bulk.

5.4 Access tokens

The MCP Server uses signed bearer access tokens that carry the authenticated user identity, company identity, and permission information needed for authorisation.

The current design uses stateless signature validation against a published key set. No tool executes without a validated identity; anonymous tool execution is treated as a critical defect.

Tokens are not placed in URLs or written to application logs.

Access tokens expire after 1 hour. Refresh tokens expire after 14 days, are stored in Azure Key Vault, and are rotated annually. Access tokens use RSA-SHA-256 signing (RS256), with signing keys rotated annually.

6. Tools, permissions, and action safeguards

The MCP Server exposes defined tools rather than a raw database connection. Tools are classified by access type and are subject to the shared Awardco authorisation model.

Representative tool categories include:

Write tools have additional safeguards:

• The user must explicitly confirm final details before a write is committed.
• Program-creation tools create programmes in Draft status only.
• Tools cannot modify a live, running program through the draft-program workflow.
• Field-level controls identify which fields are settable, gated, or excluded.
• Financial settings, approval maps, lifecycle transitions, file uploads, and other higher-risk settings may remain excluded from tool-based modification and require the Awardco user interface.

Customer-registered tools are not supported in this release.

7. Data processing and storage

Awardco Intelligence stores or processes the following categories of information in addition to data already held by the Awardco platform:

Awardco limits the data presented to an AI model to the user’s messages, required system context, and results from tools the user is permitted to invoke. Tool results are subject to result-size limits.

Engage survey response data is not reachable by Awardco Intelligence in this release because no Engage survey-response tool is currently available. Any future Engage tool must enforce applicable confidentiality thresholds and data-visibility settings before release.

8. AI model providers and data handling

Awardco uses enterprise-grade generative AI services hosted in secure cloud environments provided by Microsoft through Azure OpenAI Service and by OpenAI under commercial enterprise agreements. The current production model is GPT-5.6 Luna  , in the GPT-5 model family.

Real-time generative AI features, including Recognition Assistant and Automated Translations, send secure external requests to the Azure API for processing. Awardco’s proprietary machine-learning models run on secure internal infrastructure that uses Kubernetes clusters and Azure Databricks.

Awardco does not use Customer Data or Customer Confidential Information to train, refine, or improve external third-party models. Under Awardco’s enterprise agreements, requests sent to third-party LLMs are processed as stateless inference interactions and are not stored or used by providers for model training. This commitment concerns customer request and response content; OpenAI Enterprise system-usage logs are retained separately for approximately 30 days on servers in the United States solely for abuse monitoring and are then permanently deleted.

AI-generated outputs, such as suggested Recognition Assistant text, are stored securely in Awardco production databases in the same geographic region as the customer’s core tenant data. By default, core customer data is retained in the platform for six years unless the customer configures a different retention period in its Awardco instance.

Awardco’s internally developed machine-learning models are trained only on de-identified and anonymised platform data with Personally Identifiable Information removed.

AI features are opt-in. Awardco will not automatically activate an AI system that processes Customer Data without the customer’s instruction, and customers must have the ability to enable or disable applicable AI features.

Awardco conducts model reviews that may include:

• Accuracy testing against reference datasets and edge cases.
• Bias and fairness checks.
• Explainability assessment where provider capabilities are available.
• Review of user feedback and observed errors.
• Re-validation when a third-party model changes.

9. Transport security and encryption

• Awardco Intelligence traffic uses HTTPS.
• Data at rest is encrypted using AES-256 in accordance with Awardco platform practices.
• The In-App Chatbot inherits platform session-cookie and anti-forgery protections.
• External MCP access uses OAuth access tokens rather than platform session cookies.
• Regional deployments use independent service and data-store boundaries.

10. Logging, monitoring, and audit

Awardco Intelligence supports logging of security-relevant events, including:

• Token issuance, validation, rejection, and scope mismatches.
• Permission failures, including the requested tool and required versus actual permission.
• New external-client connections.
• Tool invocations and result outcomes.
• Result truncation events.

Audit logs are stored in the Azure database for 90 days. MCP telemetry is stored in Azure Application Insights for 90 days.

Customers do not currently have visibility into audit logs and MCP telemetry.

Awardco’s monitoring approach is intended to support troubleshooting, abuse detection, reliability analysis, and incident response without placing access tokens in application logs.

11. International use and data residency

Awardco Intelligence is designed for independent regional deployments. The current draft identifies the following availability status:

Awardco maintains separate application instances and databases for each supported region. A customer’s Awardco data is processed and stored in the region configured for that customer’s Awardco platform.

Regional activation includes checks for service health, signing-key availability, edge routing, certificate provisioning, and regional data-boundary behaviour.

Model inference for each region is processed within that region’s geography.

12. Security testing, limitations, and exclusions

Awardco Intelligence has completed third-party penetration testing covering the authorisation service and MCP Server. Findings were remediated, including redirect-URI restrictions for dynamic registration. The Awardco Intelligence attestation is available on the Awardco Trust site.

Known limitations and exclusions for this release include:

• Customer-registered tools on the MCP Server.
• Server-Sent Events transport for the MCP Server.
• Proactive AI nudges or unsolicited AI-initiated actions.
• File upload to the In-App Chatbot.
• Engage survey-response access.
• Customer-admin controls and self-service enablement, which are planned for a later release.
• Customer-facing tool-management administration UI.

Awardco limits prompt-injection opportunities through feature design and input constraints. Awardco performs application-level security assessments and adversarial testing of AI features, including evaluation of inputs, outputs, intended use, and safeguards. Each LLM request is treated as a new, stateless request and does not influence model training.

The platform uses automated content-filtering tools and APIs to block profanity, toxic language, and inappropriate phrasing. For features such as External Recognition Moderation, Awardco combines the OpenAI Moderation API with proprietary automated filters to identify potential Personally Identifiable Information or sensitive HIPAA data and flag it for removal before publication.

Awardco requires human review before AI-generated content is committed or published. The AI operates as a recommender rather than an automated decision-maker: users must review, edit, or approve Recognition Assistant suggestions, and company administrators retain final decision-making authority for moderated content. Awardco also calibrates and verifies AI safety boundaries against dedicated validation datasets and edge cases on a regular basis.

The authorisation model limits an AI interaction to the authenticated user’s existing Awardco permissions, but authorisation controls alone do not prevent prompt injection or incorrect model output. Users should verify important configuration details and review proposed actions before committing them.