Sharing with clients without giving them an AI

On Plexara a person outside your company is an account in your identity provider, given a role there like any employee. That role maps to a persona your admin has marked external, typically one per outside organization, so a supplier, an agency client, and an auditor each see only their own work. They sign in the same way your people do, and admin screens mark their account External wherever it appears.

Adding the person happens in your identity provider. What they can reach is decided in Plexara, by the admin who edits the external persona and by the people who share work with it.

An external person opens exactly what has been shared with them, one item at a time or through their persona, and they always open it as a viewer, whatever the share says. They see the live report, not a copy, so the dashboard an automation refreshes every morning is current when they look at it. They can read and reply in the shared feedback thread on an item, and they never see an internal thread, not in a list, not as a count, not by guessing its address. If their role allows it, they can send files back into a folder of their own, which your staff see under external files.

They never reach an agent. An external persona calls no tool, whatever its rules say, so there is no query, no search of your data, no connection, and no MCP access of any kind. That refusal is in the platform’s code, not in a setting someone might change by accident. They also cannot share anything onward or see your people directory.

The portal admits them to a short fixed list of areas: their shared items and collections, the threads on them, and their notifications. Every other area is refused, including any area added in a later release, so a new feature never quietly becomes visible to clients.

The Share dialog is built around one question: who can open this item. You add people from the directory, groups defined by role, or a guest by email address, and give each viewer or editor access. Shares to a group follow its membership, so someone who joins the client’s persona next month sees what the group sees, and someone who leaves stops seeing it.

Every report and collection has one general link, set to admit only the people added, anyone who can sign in, or anyone holding the link for a fixed time. Changing that setting keeps the same address, so a link already sent in an email follows the new rule. Posting an item to a Slack or Mattermost channel creates a link you can revoke later, and removing it stops the posted link working.

Sooner or later someone follows a link they cannot open. Instead of a dead end, they are shown who owns the item and can ask for access with a note. The owner approves or declines from the email, the Inbox, or the item’s Share dialog, and the person is told either way. Requests are limited per item per day, an unanswered request expires on its own, and an admin can see and answer all of them.

ACME, the retailer on the Plexara demo, buys much of its range from a wholesaler called Blue Harbor. A buyer asks the agent for a monthly report on how Blue Harbor’s products sell, by category and region, and an automation refreshes it on the first of each month. The buyer creates a collection with that report and the margin review, and shares it with the Blue Harbor external persona.

Blue Harbor’s account manager signs in through ACME’s identity provider and sees two items, live, and nothing else. They leave a question in the shared thread on the margin review. ACME’s buyer answers it there, while the internal thread on the same report, where the team discussed pricing, stays out of view. When Blue Harbor sends next quarter’s price sheet, it goes into their uploads folder, where the buyer finds it under external files.

The rule inside Plexara has always been that access starts closed and is granted on purpose. External personas carry that rule to people outside the company and make it stricter: no tools at all, a fixed list of portal areas, viewer access only, and nothing new without a person deciding it. Closed by default explains the principle.

This replaces the client portal, the external file share, and the BI viewer seat for the many cases where the outsider only needs to see results and send files back. It does not let outsiders query your data or use an agent. If a partner needs that, they need their own access, granted deliberately. See Client Access for the product, Governance for how personas are set up, and Portal Tour for the Share dialog.