Autonomy,
under control.
An AI that acts on its own must stay controllable. Governance isn't an add-on — it's native, at every tool call.
Locking sensitive actions
Governance comes down to a switch. In supervised mode, every tool you flagged "require my approval" — typically an email send, a publication, a financial action — is intercepted before it runs and waits for your go-ahead. In autonomous mode, the assistant acts on its own and everything stays logged. Nothing is hard-coded: you decide, tool by tool.
| mode | behavior | for whom |
|---|---|---|
| Supervised | Only the tools you flagged "require my approval" are intercepted → proposal. All others pass. | Cautious rollout — sensitive actions under control. |
| Autonomous | The assistant acts on its own — everything is allowed, and everything is logged in the audit. | Trust established — maximum speed. |
| Per-tool switch | Each tool carries its own "require my approval" switch: you pick exactly what needs your go-ahead. | Fine-grained control, tool by tool. |
extensible system — each tool, native or added, can declare its own locked actions. The Lock Manager is an open protocol, not a fixed list: the control surface adapts as the ecosystem grows.
Proposals: actions requiring approval await your decision
A locked action isn't executed: it becomes a proposal you approve, reject, or defer from a console. Once approved, the action is replayed exactly as captured.
Who did what, when
Every decision — allowed, refused, validated — is written append-only. The audit trail enterprises need.
Capped costs
A ceiling per instance. Top-ups require an explicit approval — no billing runaway.
Freeze it all, instantly
A single control pauses every autonomous task on the instance. Everything can be disabled instantly.
Supervised or autonomous
Switch between supervised and autonomous, globally or per profile. Supervised: only the tools you tick go through approval; autonomous: everything is allowed but logged.
Partitioned where it matters, shared where it helps
A single instance can host several "personalities" — a main assistant, a monitoring agent — each with its own private memory, contacts, tools and channels.
A profile's private memory is never read by another without an explicitly configured share. Two spaces, however, are common by design: the document cabinet (reference sheets) and the company directory — so the assistant and the autonomous agents draw on the same files and contacts. The strongest isolation is between instances: each client has its own — separate containers, database and volumes.