Cuttlefish

Evaluate the identities, authority and outcomes together.

getcuttlefish.app/technical/enterprise-boundaries2026-10-23

Identify who owns the work and its access

An enterprise evaluation should distinguish the organization, the person, the operating agent and the connected account used for an action. Those identities answer different questions. A participant’s name in the interface is not sufficient proof that it belongs to the intended organization or has the required permission.

Home’s coordination and a Companion’s independent execution remain subject to the organization’s policy. Delegating a task does not automatically transfer all of a person’s access. Sharing a result should preserve the source and recipient boundaries appropriate to that material.

Connect product behavior to organizational rules

Organizations need to decide what agents may read, prepare and change; which operations need a decision; and which must not happen. Those rules should follow the actual identity, operation and target. The same operation can have a different disposition in another organizational context.

Use representative positive and negative cases. Check that allowed work can proceed, review-required work reaches the right decision point, and prohibited work is refused. Also examine what happens after access expires, membership changes or a connection is revoked. A successful happy-path demonstration does not establish those boundaries.

Evaluate each integration at its real boundary

Confirm the account and environment a connection actually uses, the operations it supports and the information it can return. A tool catalog describes available functionality; it does not prove that the intended credentials, authorization and target are configured.

Browser and desktop operations need the same care as API connections. A prepared change and a submitted change are different outcomes. Verify results at the relevant system, and retain an honest unresolved state if the system’s response cannot establish what happened.

Ask concrete deployment questions

Establish the supported native platforms and current accepted release for the intended users. Identify which functionality runs in the installed client, which needs hosted services, which providers are configured and which organizational systems will be connected. Do not infer the deployment topology from a website example or a historical diagram.

Evaluation should cover identity setup, authorized provider access, connectivity, operational visibility, updates, interruption and recovery. The current Enterprise guidance and controlled commercial agreements determine the actual deployment offering; this page does not promise an unqualified hosting mode or certification.

Use acceptance that matches the claim

An available installer proves that bytes can be obtained, not that a particular organization has accepted the installed workflow. A healthy service endpoint proves reachability at a point in time, not successful authorized work. A model answer is not proof of an external effect.

For a meaningful evaluation, use the intended identities and sources, inspect both permitted and refused operations, interrupt representative work and examine the resulting state. Match each completion claim to the observed behavior and state explicitly where evidence is unavailable or the environment has changed.

Use the controlled references for their commitments

Trust brings the current assurance material together. Security describes the public security controls and reporting route. Privacy, Terms, the DPA and Subprocessors govern their respective commitments. The technical references help reviewers understand operating relationships without rewriting those documents.

If your reviewers need information beyond the public boundary, use the official enterprise or security evaluation channel. Public website Home answers from admitted public sources and cannot provide private deployment details, confidential customer information or unpublished implementation material.

A public visit is not an enterprise session

The public website has its own guest context, available sources, configured model and operating limits. It does not become a visitor’s installed organization because they describe their company or ask Home to act as an administrator. Its example organizations and Juniper Coffee work remain illustrative.

Downloading Cuttlefish is a separate step toward an installed evaluation. It neither installs the program automatically nor gives the website access to the visitor’s files, desktop, provider account or authenticated applications.