You keep the last word
An agent only does what its trust level, its connectors, its budget and its policy allow. Here is how each of those works.
Three rungs, the lower one wins
Every action is read, draft or act. Set what the connector allows and what the agent asks for. The lower level decides.
The trust ladder
Every action an agent can take sits on one of three rungs.
- ReadLooks and learns. Nothing changes outside, so it runs without asking.
- DraftPrepares an action, such as a message. It waits in the approval queue for a person.
- ActDoes it now. Used only where you allowed it.
The effective level is the lower of the action's level and the connector's scope. A connector set to draft can never act, whatever the agent asks for.
The road of one action
Before an action runs, it passes four checks.
Connector scope
A connector caps what an agent may do with it: act, draft or read.
Policy
Allow and deny tools and hosts, block patterns. Deny wins.
Approval
A draft waits for a person, who may edit it first.
Budget
A run over its budget is skipped with a budget error.
Approvals
Edit before you approve
The approver can change the action's arguments. Disclosure is checked again after the edit.
Ask a person mid-run
An agent can pause with a question. The answer resumes the run.
Pre-approval of one publication
Approve exact text and files in advance, for a short window, once.
Budgets
Three levels
Per run, per agent per day, and per project per day.
A hard stop
A run over budget is skipped with a budget error. Parallel calls reserve budget atomically.
Auto-pause
Three failed runs in a row pause the agent.
Policy
Set per project and per agent. Deny wins.
- Allow or deny tools
- Require approval for named patterns
- Allow or deny hosts for every URL in the arguments
- Deny patterns over arguments and output
- Quiet hours and per-run caps
- Read-only mode
- Plain-language rules added to the prompt
Isolation
Walls around the work
Host files behind an allowlist
A path allowlist per project and a hard denylist for keys and keychains.
Private project memory
A project cannot read another project's memory unless a share policy says so.
Code runs in containers
Read-only root, dropped capabilities, bounded CPU, memory and processes, and an egress allowlist.
Security reviews
Findings from security reviews go into a defect register, and every entry has a regression test. This is a record of work done, not a certification.
Where this is not finished
Content guardrails, per-operation risk contracts and treating tool results as untrusted data are built or partly built but not switched on yet. See the status page.
What is ready and what is notEarly access starts with a call
The product is at an early stage with a single operator. The repository is private and the terms are not set. If this fits a problem you have, book a short call.
A 20-minute call with the author. The repository is private, so a conversation is the way in.