BEFORE
Per Michael's new contract, he will receive a $10,000 relocation allowance and 5,000 RSUs vesting over four years, plus a 12-month non-solicitation clause.
For product and partnership leaders considering a partnership with Workfabric AI. Twelve twin use cases, grouped by the kind of platform you build, so you can quickly see what ContextFabric makes possible on top of yours.
ContextFabric is the simulation and context layer for your enterprise. It senses operational context across the apps your people already use, structures that context into living digital twins, and exposes it to any AI agent through MCP.
Delivered as a managed service with a fully isolated, dedicated Data Plane per customer — run on dedicated Workfabric AI resources we manage for you, or in your own cloud (Azure, AWS, GCP). Either way, no shared service plane and no shared inference path.
On each user device. Observes how work happens, under your governance and scope.
Workflows, participants, business objects, data sources — all linked back to their origins.
Selects, enhances, and ships precise context aligned to each agent request.
Any agent runtime reads context the same way.
The signal lives in the work itself — every step performed, every exception, every off-path decision.
ERP records, accounting, support tickets, dashboards — structured but partial.
Conversations, emails, chat, transcripts, documents, SOPs, contracts.
Every step, every variation, every error and how it was resolved.
What gets captured per workflow
20 billion observed tokens → 100 million refined → 5 thousand precise context tokens per agent request.
A single Control Plane manages the platform globally, while every customer's Data Plane — including its storage and compute — stays fully isolated, whether it runs in your VPC or on dedicated Workfabric AI resources we manage for you.
Whether your cloud or ours, your ContextFabric storage and compute are always isolated to your enterprise.
Run in your own VPC, or on dedicated Workfabric AI resources we manage for you — the same isolated Data Plane either way.
The same Control Plane / Data Plane model deploys consistently across Azure, AWS, and GCP.
The Operator applies centralized policy and seamless updates across every region — without disrupting your agents.
ContextFabric is built with strict boundaries between the Workfabric Control Plane and your Data Plane — encrypted in transit, encrypted at rest, no inbound connections, and only the Data Plane initiates a single secure egress channel back to the Control Plane.
Context data and operational metadata live in three places — your team's user machines, the ContextFabric Data Plane, and the Workfabric Global Control Plane. Each store has its own purpose, encryption, and retention policy. Items in matching dashed colors flow between planes — blue for configuration, orange for operational telemetry.
ContextFabric sits underneath the AI stack you already run. Nothing ripped, nothing replaced.
Out-of-the-box compatibility across ERP & finance, CRM & CX, HR & workflow, analytics & tools — plus custom and legacy.
Any framework that speaks Model Context Protocol can read ContextFabric. No SDK lock-in.
Output works with all leading generative AI models. Swap models without re-integration.
A background process on each user's device, with the user's awareness of it running. It captures how work is actually performed — at the edge, on the desktops and applications your teams already use. No interaction required; as people work, their digital twin begins to model them.
Indicators of focus such as dwell time, switching patterns, and rework.
Clicks, keystrokes, navigation, field entries, copy/paste, and search.
Which app, view, or field the interaction took place in.
Timestamps, user/session IDs (PII-filtered), and traceability markers.
Every rule lives in the ContextFabric Trust Center. Privacy-protection rules run wherever they're most effective — at the Edge, matching patterns of sensitive information like SSNs and credit cards before anything leaves the device; or at our Server, where advanced semantic rules scrub context as agents request it. We ship 100+ rules out of the box, and you can author custom rules at both the edge and the server.
Detects and removes well-formed sensitive patterns — SSNs, credit-card numbers, account IDs — on-device, before context is ever transmitted.
Natural-language policies scrub context as agents access it, catching sensitive meaning that simple patterns miss.
Every rule can act as Redact or Drop. Redact keeps the surrounding context and removes only the sensitive subset in-place. Drop is stricter — if the policy is triggered, the entire surrounding context block is removed for safety.
The employee's SSN is 482-36-7291 and their salary is $145,000.
The employee's SSN is [SSN] and their salary is [SALARY].
Entire context block removed — contained sensitive data.
Scrubbed on the server when AI agents access context from ContextFabric. Up to 100 policies per context group — 65 active.
ContextFabric is built on a thesis: the context AI agents need in the enterprise is not waiting to be retrieved — it has to be synthesized from how people actually work. The X-SYNTH paper sets out the framework that makes that synthesis tractable, and shows what it produces when you augment a frontier model with it.
Each worker's observed digital human attention is a learnable, discriminative relevance signal, with no external labels required.
The same query resolves to different signals for different people, because what looks meaningful depends on how that specific worker actually operates.
On a sales lead identification benchmark drawn from Fortune 500 interaction data, the same model augmented with this framework surfaces 110 additional real leads it had otherwise missed entirely.
Raghavan, G., Nychis, G., & Murty, R. (2026). X-SYNTH: Beyond Retrieval. Enterprise Context Synthesis from Observed Digital Human Attention. Workfabric AI.
Not every agent should see every team's context. Context Groups are the unit of governance in ContextFabric: a Context Contributor belongs to exactly one group, which defines what work it's OK to model from which applications. AI agents are then explicitly assigned to one or more groups — so an engineering agent is powered by engineering context without ever reaching HR context, even though the HR team's own agents need that same context to do their jobs.
Every contributor belongs to exactly one Context Group. The group governs which applications, URLs, and entities are OK to model — with full visibility into what gets captured and what doesn't.
Agents are securely assigned to one or more Context Groups. They can only synthesize context from the groups they're attached to — no implicit access, no cross-team leakage.
| AI Agent | Goal |
|---|---|
| Account Briefer | Co-pilots account managers — surfaces account context, open initiatives, and recent customer interactions before each call. |
| Deal Hygiene | Identifies missing fields and inconsistencies on open opportunities so reps can clean them before pipeline reviews. |
| Forecast Assist | Surfaces early-stage demand signals and pipeline shifts to support sales-leader forecasting. |
| Opportunity Creator | Identifies and creates new opportunities in the CRM from customer interactions captured by the runtime. |
Within each Context Group, admins decide exactly which applications ContextFabric is allowed to model — not just by category, but down to individual apps and URLs. Sources are ranked by the time and effort contributors actually spend in them, so the highest-impact applications surface first. Turn modeling on for the work that matters; leave the rest blocked.
| Source | Time spent | Activity % | Status |
|---|---|---|---|
| ZendeskAPP zendesk.com · updated Apr 12 |
30h 40m | 7.5% | BlockedModeling |
| ServiceNowAPP servicenow.com · updated Apr 11 |
8h 30m | 3.6% | BlockedModeling |
| IntercomAPP intercom.com · updated Apr 09 |
4h 00m | 2.4% | BlockedModeling |
| support.acme.comURL support.acme.com |
18m | 0.8% | BlockedModeling |
Agents pull context from ContextFabric with a single MCP-compatible call. They tell ContextFabric why they're working (intent) and what's in front of them right now (action). The service synthesizes a precise slice of the Context Library and returns it as agent-ready context — built from interaction signals captured at the edge as your team works.
A sales rep is stuck on a Business Deal — searches for an initiative are returning no records. The agent asks ContextFabric what the rep has already tried so it can suggest the right next step.
import os, requests
resp = requests.post(
"https://acme.context.workfabric.com/retrieve-context/v1/context",
headers={
"Content-Type": "application/json",
"X-Api-Key": os.environ["WORKFABRIC_API_KEY"],
},
json={
"agent_id": "agt_sales_dealbuilder",
"intent": (
"You are an AI assistant for sales reps building Business Deals in "
"CloudSales Suite. Surface the account context, the initiatives the "
"rep has searched, and any contract references that still need to be "
"linked so the deal can be completed."
),
"action": (
"On the New Business Deal screen for Orion Global Solutions Ltd. "
"(Business Deal 2000587643), what initiatives has the rep searched "
"for, and what was the result?"
),
},
)
context = resp.json()["context_shipped"]
# ContextFabric synthesizes `context` from interaction signals captured at the
# edge as your team works. One such signal is shown below.{
"user_uuid": "9f3a71c4-8b92-4d5f-a6e1-2c7b9e41d210",
"timestamp": "2025-12-04 17:59:31",
"application": "orgfarm-7ef58e5a10-dev-ed.develop.lightning.force.com",
"embedding_sentence": "\n A user is search a Business Deal with the\n attributes {Customer Customer Account Name: Orion Global Solutions Ltd., Header: Sales Deal, Label: Select Initiatives to include in your Business Deal, Status: No Records Found, entity_identifier: 2000587643} using orgfarm-7ef58e5a10-dev-ed.develop.lightning.force.com application on screen 'New Business Deal | CloudSales Suite' with\n intent : \"The user aims to find and include a specific project in their sales business deal, ensuring it has an associated contract reference ID for visibility.\"\n ",
"meta_data": {
"screen_fields": [
{
"screen": "New Business Deal | CloudSales Suite",
"interacted_fields": [
"If your Delivery Initiative pursuit is for an existing initiative then your delivery initiative must have an associated contract reference ID in ContractSphere to show in the below.\n",
"Search Initiative Name Initiative ID",
"Search",
"Your Delivery Initiative pursuit is for an existing initiative then your delivery initiative must have an associated contract reference ID in ContractSphere to show in the below\n"
]
}
],
"absolute_url": "https://orgfarm-7ef58e5a10-dev-ed.develop.lightning.force.com/lightning/o/Business_Deal/new"
},
"entity": "Business Deal",
"intent": "The user aims to find and include a specific project in their sales business deal, ensuring it has an associated contract reference ID for visibility.",
"date": "2025-12-04",
"entity_identifier": "2000587643",
"action": "search",
"attributes": {
"Label": "Select Initiatives to include in your Business Deal",
"Header": "Sales Deal",
"Status": "No Records Found",
"Account Name": "Orion Global Solutions Ltd.",
"entity_identifier": "2000587643"
},
"knowledge": "The user is searching for an existing delivery initiative related to a business deal by entering an initiative ID.",
"effort": 5.0
}Each field, search, and button the rep touched on the screen — modeled from the team's digital interactions, not self-reported.
meta_data.screen_fields.interacted_fieldsContextFabric infers a plain-English intent — and a short summary of what the rep knows — from the behavior itself. Nothing typed by the user.
intent · knowledgeThe application, the screen, and the exact record URL — so the agent (and any auditor) can trace the signal back to the SaaS surface it came from.
application · meta_data.absolute_urlThe other attributes available when the rep acted — account, status, identifiers, labels — the operational context that gives the action meaning.
attributesAn account manager has a renewal call tomorrow. The agent asks ContextFabric to summarize where the deal stands — what the customer has raised, what pricing options are on the table, and what alternatives they're weighing — so it can propose the right opening and next steps.
import os, requests
resp = requests.post(
"https://acme.context.workfabric.com/retrieve-context/v1/context",
headers={
"Content-Type": "application/json",
"X-Api-Key": os.environ["WORKFABRIC_API_KEY"],
},
json={
"agent_id": "agt_account_briefer",
"intent": (
"You are an AI co-pilot for account managers preparing customer "
"renewal conversations. Summarize the current state of the deal "
"— open concerns, pricing options on the table, the customer's "
"stated alternatives — and recommend the strongest next steps "
"and talking points for the upcoming call."
),
"action": (
"Brief me on the Meridian Trust Bank account for tomorrow's call: "
"where do we stand on the renewal and cost negotiation, what "
"concerns has the customer raised, what alternatives are they "
"considering, and how should the rep open the conversation?"
),
},
)
briefing = resp.json()["context_shipped"]
# The synthesized briefing returned by ContextFabric is shown below —
# the agent can append it to its prompt to compose talking points and
# a recommended opening for the call.Here's a concise summary of recent context on the Meridian Trust Bank account (as of 2026-05-25):
Suggested next steps and talking points for tomorrow's call:
All network connections are encrypted in transit with mutual authentication. All persisted data is encrypted at rest with keys dedicated to your environment — keys are never shared between customers. ContextFabric runs as a global Control Plane operated by Workfabric AI and a dedicated, isolated Data Plane per customer; context is stored only in the Data Plane (see Isolation & Tenancy below).
The Data Plane accepts no inbound connections. Its only external traffic is a single authenticated, egress-only channel to the Control Plane, and internal service traffic remains within the customer-configured VNet / VPC.
Identity comes from your identity provider. Access is mediated three ways: fine-grained roles for people, scoped and revocable keys for users and agents, and Context Groups as the hard boundary on which context any agent can reach.
Users authenticate through your SSO provider; sessions carry your identity provider's tokens. The Control Plane stores only the user's email and name, encrypted at rest.
Role and permission management governs administrators, Context Contributors, and AI agents — across the Context Library and every management surface.
Every user and agent API key is scoped and revocable at any time — stored in your Data Plane, cutting access instantly when revoked.
Not every agent should see every team's context. A Context Contributor belongs to exactly one group, which defines what work it's OK to model from which applications. AI agents are then explicitly assigned to one or more groups — context is controlled from creation all the way through agent access, with no implicit access and no cross-team leakage.
Every contributor belongs to exactly one Context Group. The group governs which applications, URLs, and entities are OK to model — with full visibility into what gets captured and what doesn't.
Agents are securely assigned to one or more Context Groups. They can only synthesize context from the groups they're attached to — no implicit access, no cross-team leakage.
Context capture starts on user devices. The AI Twin Runtime minimizes what persists on the endpoint: interaction data is encrypted and held briefly before transfer, and all transmission goes over the encrypted channel to your Data Plane.
Each data store in the platform has a defined protection mechanism and retention policy, summarized below.
| Data | Where it lives | Protection | Retention |
|---|---|---|---|
| Digital interaction data | User device → Data Plane | Encrypted at rest on-device; TLS in transit. | ≤ 2 min until transfer |
| Context Library | Data Plane | Encrypted at rest with environment-dedicated keys. | 1 month default |
| Context source data | Data Plane | Encrypted at rest with environment-dedicated keys. | Matches Context Library |
| User & agent API keys | Data Plane | Encrypted; revocable at any time. | Until revoked |
| Service logs | Data Plane · Control Plane | Service and endpoint health, request metadata only. | 30 days |
| Onboarded user account | Control Plane | Encrypted at rest; email and name only. | While user is active |
No. ContextFabric splits into a global Control Plane — orchestration, policy, updates, and monitoring, operated by Workfabric AI — and a dedicated Data Plane per customer holding all storage, compute, and model inference, in your cloud or on dedicated Workfabric AI resources we manage for you. Context is not stored in the Control Plane, and no Data Plane is shared between customers.
Dedicated storage, dedicated compute, and a dedicated inference path per customer. No shared service plane — in our cloud or yours.
Workfabric personnel do not require access into your Data Plane. Updates and configuration are delivered through the controlled egress channel.
Your Data Plane runs in the region you choose; only metadata and configuration are stored in the Control Plane. Workflows, business objects, and traces remain in your environment.
Security fixes are pushed from the Control Plane through the authenticated channel. No personnel access is required to apply updates.
Every context unit an agent receives can be traced back to its origin. ContextFabric maintains semantic links from the context an agent consumes all the way down to the data sources and interactions that generated it.
Workflows, participants, and business objects link back to the systems, documents, and interactions that generated them.
Raw data → semantic entities → workflows → intent. Each layer preserves semantic links down to the layer below, so any context unit resolves to its raw origin.
Verifiable tags are embedded in context inside your Data Plane, while unified audit frameworks run in the Control Plane — audits are supported without requiring access into your environment.
ContextFabric undergoes annual third-party penetration testing across all APIs, cloud infrastructure, and the endpoint client, and Workfabric AI is undergoing a SOC 2 audit covering all of its operations.
ContextFabric has two halves to roll out: the AI Twin Runtime on each user's device, and the ContextFabric Environment (the Data Plane). Both are designed to deploy with tools your IT team already runs.
A background process on each user's device, with the user's awareness of it running. At scale, the Runtime is deployed centrally with Microsoft Intune or SCCM on Windows, and Jamf on macOS — the same endpoint-management tools you already use.
| Dimension | Requirement |
|---|---|
| OS | Windows 10 or 11 |
| CPU | 4 cores · Intel i5 or better (i5-6600 for reference) |
| RAM | 16 GB |
| Disk | 2.5 GB |
| Network | 1 Mbps egress |
| Dimension | Requirement |
|---|---|
| OS | macOS 25 (latest) |
| CPU | Apple Silicon (M1 · M2 · M3 · M4 · M5) |
| RAM | 16 GB |
| Disk | 2.5 GB |
| Network | 1 Mbps egress |
Your Data Plane — a fully isolated environment with dedicated compute, dedicated storage, no shared service plane, and no shared inference path. Two ways to run it.
For any scale, small or large.
The simplest path. Workfabric AI provisions and operates dedicated, isolated compute and storage for your enterprise — no cloud accounts to set up, no Kubernetes clusters to maintain, no networking to configure. Your context data, models, and inference path remain dedicated to you. Your team gets context the day they sign in.
For enterprise contracts of 1000+ AI Twin Runtimes.
Run the same isolated Data Plane inside your own cloud account. Same architecture across clouds — only the underlying resource types change. See the per-cloud reference specifications below.
For enterprise customers that meet the criteria for Option 2, here are the reference resource sets per cloud. Same architecture and isolation guarantees in each — only the underlying resource types change.
All ContextFabric services run inside your Azure subscription, in a customer-configured VNet — internal service calls never traverse the public internet. The only external traffic is the secure, authenticated egress to the Workfabric Control Plane for configuration, telemetry, and upgrades.
| Category | Resource | Specification | Purpose |
|---|---|---|---|
| Compute | AKS Cluster | 1 node · Standard_D8s_v5 | Runs all ContextFabric services — Operator, Context Creation, Context Synthesis, and the MCP interface. |
| Database | Azure PostgreSQL | Standard_D4ds_v4 · 256 GB | Context Library — structured context, retrieval indexes, semantic metadata, privacy policy config. |
| Storage | Azure Blob Storage | 1 TB | Context Source Data — raw, unstructured inputs from which ContextFabric distills knowledge. |
| Security | Azure Key Vault | Standard tier | Customer-managed encryption keys for data at rest and runtime secrets. Workfabric never holds your keys. |
| Networking | Azure VNet | Customer-configured | Network isolation — internal service-to-service traffic stays within the VNet boundary. |
| AI models | Azure AI Foundry | GPT-4o-mini · 1M TPM GPT-4.1 · 0.2M TPM GPT-5-nano · 2M TPM text-embedding-small · 1M TPM |
Model runtime for context creation, synthesis, and embeddings. |
The AWS deployment translates the Azure architecture into AWS-native services — same Control Plane / Data Plane split, same isolation guarantees, same egress model. All ContextFabric services run inside your AWS account, in a customer-configured VPC.
| Category | Resource | Specification | Purpose |
|---|---|---|---|
| Compute | Amazon EKS | 1 node · m6i.2xlarge | Runs all ContextFabric services — Operator, Context Creation, Context Synthesis, and the MCP interface. |
| Database | Amazon RDS for PostgreSQL | db.m6i.xlarge · 256 GB | Context Library — structured context, retrieval indexes, semantic metadata, privacy policy config. |
| Storage | Amazon S3 | 1 TB | Context Source Data — raw, unstructured inputs from which ContextFabric distills knowledge. |
| Security | AWS KMS | Customer-managed keys | Customer-managed encryption keys for data at rest and runtime secrets. Workfabric never holds your keys. |
| Networking | Amazon VPC | Customer-configured | Network isolation — internal service-to-service traffic stays within the VPC boundary. |
| AI models | Amazon Bedrock | Amazon Nova Micro · 1M TPM GPT-5.4 · 0.2M TPM GPT-5.4 (low reasoning effort) · 2M TPM Amazon Titan Text Embeddings V2 · 1M TPM |
Model runtime for context creation, synthesis, and embeddings — Bedrock-native equivalents of the Azure model set. |