PR #363 (sso_user_id_updates by CapitolCoder) — 527 additions, 8 deletions, 3 files
PR #362 (feature/COM-18-ad-phase-1 by jordotech) — 8 additions, 1 deletion, 1 file
Both PRs add Authorization: Bearer header support to get_current_user() so SSO users can authenticate with agentic-backend.
| Aspect | PR #363 | PR #362 (ours) |
TL;DR: The skills/ directory is 3.6MB / 282 files — smaller than a single retina screenshot. Splitting it into a separate repo adds real operational complexity to solve a non-problem, and partially reintroduces the version-coupling failures that caused the outages we're trying to fix.
Total: 3.6 MB, 282 files
ENG-857: Replacing Celery with Async Workers — Internal Briefing
Branch: feature/ENG-857-no-celery (agentic-backend + terraform)
Status: Deployed to HMG, ready for load testing
Capitol.ai is a multi-tenant platform where organizations share the same AWS infrastructure. A Capitol.ai admin can add themselves to any organization (e.g., EY) and gain full access to that org's S3 files — uploads, workflow files, and generated outputs. Client orgs need assurance that only users with verified email domains can access their data.
We implement email-domain-scoped IAM role assumption — a belt-and-suspenders approach combining STS AssumeRole with explicit IAM Deny policies.
Capitol AI has implemented platform-level access control that restricts who can view and download an organization's files. Access is determined by the user's verified email domain — only users with authorized email addresses (e.g., @ey.com) can access the organization's data, even if other users have platform administrator privileges.
This control works alongside the existing External Key Management (EKM) encryption to provide multiple independent layers of data protection.