The discovery set never leaves the box

A litigation team receives 200GB of discovery: PDFs, emails, spreadsheets. Six contract reviewers need to read it. Six laptops full of privileged material is a problem waiting to happen.

The set lands on one container. Each reviewer gets a workspace URL: a files panel that previews PDFs inline, a SQLite panel where the privilege log is a table, and nothing else. The proxy permission group for reviewers allows files and sqlite and denies terminal and exec.

Someone needs every email mentioning the CFO by name. /api/v1/files/grep/discovery/emails?pattern=Hargreaves runs ripgrep across 1.4 million messages on the server and returns hits with context. Nobody downloaded a thing. Nobody ran a desktop indexer.

When the matter closes, the reviewers' group is deleted and the URLs go dark. Two hundred gigabytes of privileged material, zero copies on zero laptops.