// beta
An agent is not a person, so it should not have a person's access.
Once software starts doing work on your behalf, four questions matter. This page answers them and marks which answers are built and which are still being built, because a page that claims a protection it does not have is worse than no page.
The four questions, and where each answer stands
Status is stated per answer. Nothing is described as working because it is designed.
Question one
What can it reach?
Only the tools you granted it, and only the systems you named. It holds none of your passwords.
Status
Being built. Today an agent would reach what the credential it was given reaches, which is why this is the first thing we are closing.
Question two
What can it spend?
A daily limit you set, for each person and for each agent, which resets rather than locking someone out for the rest of the month.
Status
Being built. Your AI provider offers monthly limits today; a person who exhausts one is locked out until the month turns over, which teaches people to avoid the tool. A daily limit is ours to add.
Question three
What if it goes wrong?
You switch it off. Everything it did is recorded under its own name, not a person's. And it stops rather than guessing when something looks wrong.
Status
Partly. Stopping a job is available now. Telling an agent's actions apart from a person's in the record is being built, and until it is we will not claim it.
Question four
Can it leak my information?
Sensitive information is blocked before it reaches the AI, including the names and documents specific to your business rather than only obvious things like card numbers.
Status
Being built, and the part that is specific to you - your own client names, your own documents - is the part a general-purpose tool will never know.
Why the same thing that makes it safe makes it useful
These are not two trade-offs pulling against each other.
An agent that refuses rather than guessing, holds no passwords, and can only reach what you declared is both safer and more trustworthy to leave running. The properties that let you stop watching it are the same ones that stop it doing damage.
Which is why we do not treat protection as something added afterwards. An agent you could not stop, could not account for, and could not bound is not one you would leave alone with your business - whatever it could do when supervised.
What we cannot do
The useful part of any security page. We give every customer the full list in writing before they commit.
A person still approves the output. By design. The last check on anything carrying your name is somebody reading it.
We protect your company's AI accounts, not somebody's personal one. If an employee signs into their own account on their own phone, none of this applies, and the honest fix there is account control rather than anything clever.
We do not write your business rules. You know which report goes to which owner and why. That stays yours, it takes a sentence each, and we would be guessing.
We do not write your legal or clinical content. Where the law or a professional judgment decides the answer, that belongs to your attorney or your clinician. We build the part that makes sure nothing is missed, not the part that decides what is right.
There are further limits that depend on how you work, and we put all of them in writing for you specifically rather than listing them on a web page, because which ones matter depends entirely on your business.
What this does not require from you
Worth stating because the usual answer to security is more software on more machines.
Nothing installs on anybody's computer for the checks described above. Your AI provider supports this directly.
No IT department. None of our customers has one. If a step needs an IT person, we are the IT person.
You administer it yourself: add people, set each person's limit, see what the agents did.
One page a month, to the owner
Not a dashboard you would have to remember to visit.
Where AI was used and by which tool. What was protected. Any incidents. How many jobs ran, how many stopped themselves, and how long it has been running correctly.
And it reports zero as zero. A page claiming incidents in a month that had none would make the whole thing unbelievable, which is the opposite of the point.
Status
Being built, and it renders from the real record with nothing typed in by hand - otherwise it is a newsletter rather than a report.