Controlled access begins with identity, scope, and approval.

What is available now—and what is not.

• Public information

  Status: Available

  External AI systems may read approved public information published through the USIMEX website without authentication.

• Controlled request submission

  Status: Not enabled

  No public external-AI request form or machine submission endpoint is currently active.

• Operational actions

  Status: Disabled

  External AI systems cannot modify records, trigger workflows, send communications, approve decisions, or act on behalf of USIMEX.

• Owner-facing AI actions

  Status: Disabled

  No autonomous owner-agent actions are enabled. Consequential actions require explicit human approval.

Approved public information may be read without authentication.

• Organization identity
• Public positioning
• Public services
• Public capabilities and maturity labels
• Public industries
• Public page definitions
• Approved claims
• Public policies once published
• Public system-status information once enabled
• Public navigation and calls to action
• Public contact information when available
• Public content boundaries and disclaimers

Public availability does not grant permission to submit requests, alter records, trigger workflows, or represent USIMEX.

Future controlled requests would follow a governed path.

1. 1

   Identify

   The external AI system identifies itself, its operator, and the organization it represents.

2. 2

   Declare purpose

   The system states the requested service, intended outcome, and reason for the request.

3. 3

   Define scope

   The system specifies the information, action, records, or workflow it is requesting access to.

4. 4

   Provide consent and authority

   Required human authorization, consent records, and delegated authority must be documented.

5. 5

   Validate

   USIMEX validates identity, references, permissions, request structure, duplication, and policy compliance.

6. 6

   Owner review

   The request remains pending until an authorized human reviews and explicitly approves, rejects, or requests clarification.

This is a planned interaction model. No public request endpoint is currently available.

Controlled requests require clear identity and context.

• ✓AI system name
• ✓AI provider or platform
• ✓Responsible organization
• ✓Responsible human operator
• ✓Contact information
• ✓Requested service
• ✓Requested action
• ✓Purpose of the request
• ✓Intended outcome
• ✓Relevant industry
• ✓Relevant records or resources
• ✓Requested access duration
• ✓Consent references
• ✓Authorization evidence
• ✓Data sensitivity classification
• ✓Proposed communication channel
• ✓Time sensitivity
• ✓Human review contact
• ✓Confirmation that the AI system is not impersonating a person
• ✓Confirmation that no prohibited action is being requested

Providing this information would not guarantee approval or access.

Human approval remains the governing boundary.

• Requests remain pending by default.
• Owner approval is required before consequential actions.
• Deny rules take precedence over allow rules.
• Permission must be evaluated for the specific resource and action.
• Consent must be valid for the requested purpose.
• Approval may be limited by scope, time, resource, or action.
• Approval does not imply continuing authorization.
• Requests may be rejected without creating a client relationship.
• External AI systems may not approve their own requests.
• External AI systems may not elevate their own permissions.
• A request may require clarification before review.
• Human decisions may override automated recommendations.
• No AI system may bind USIMEX contractually.
• No AI system may represent that it has authority it does not possess.

Some access and actions remain prohibited.

• Accessing private leads
• Accessing consent records
• Accessing external AI request records
• Accessing owner notes
• Accessing owner-agent recommendations
• Accessing audit logs
• Accessing credentials or secrets
• Accessing banking, tax, ownership, or private company records
• Modifying policies
• Modifying permissions
• Modifying system settings
• Deleting or exporting private records
• Sending communications
• Creating contractual obligations
• Approving consequential actions
• Impersonating a human
• Misrepresenting authorization
• Circumventing consent
• Circumventing owner review
• Triggering autonomous workflows
• Uploading files while uploads remain disabled
• Submitting requests while external-AI intake remains disabled
• Attempting to bypass validation, rate limits, or access controls

Public content access is informational. It is not operational authorization.

Controlled access must remain reviewable.

• External AI systems must identify themselves.
• Requests must include a clear purpose and scope.
• Authorization and consent must be documented.
• Validation failures must block the request.
• Requests remain pending until human review.
• Significant actions should create immutable audit records.
• Decisions should record the responsible actor.
• Approved scope should be narrow and explicit.
• Access should expire or be withdrawn when appropriate.
• Policy and permission conflicts should resolve toward denial.
• Sensitive information should remain private by default.
• Developing capabilities must not be represented as deployed.
• System failures must not silently convert into approval.
• No request should create an implied agency or fiduciary relationship.

Some policy pages are still being prepared and may not be available yet.