Safety enforced by
code and configuration, not prompts.
Hand work to the AI and still keep rights, recipients and personal data safe. The promises are built into the protocol and the parts, and proven by the 52-check conformance suite and each part's tests.
People decide
The AI only proposes writes. Accepting and approving is done by a person, once.
Never beyond the user
AI rights = what the AI is allowed ∩ that employee's role. Tokens live 5 minutes at most.
The system picks recipients
The AI never chooses who receives anything. Only the people concerned get it.
No personal data in transit
Events carry IDs, dates and counts only. Text is screened before sending, or fixed.
Closed by default
Group chats, unattended work and delivery targets are closed by default.
Verified by 52 checks
Promises are proven by the conformance suite. Releases need 52 / 52, nothing skipped.
Only what concerns you reaches you
Your system decides who is told. The framework creates no recipients and never lets the AI choose them.
Every path from the AI to chat, and its guard
Where upstream parts ship open defaults, the product profile template ships them closed. Opening one is an explicit opt-in.
| Path | Guard | Product default |
|---|---|---|
| Rule-based notifications | Only the recipients your system returns. Email is not a default channel | — |
| Automatic-task reports | Only the recipients of the triggering event; none if undecided; fixed text | No fallback · fixed text |
| Fixed delivery targets | Never routed to a fixed bot or conversation | Restricted |
| No sending to arbitrary addresses, no inbox polling | Off | |
| Scheduled reports | Identity checked before waking; recipient and text checked before sending | Not sent without the guard |
| Model tools | No arbitrary targets, no changes to others' conversations | Reclaim only |
| Group chats | The AI does not run; a fixed guide only. Business tools refused too | Denied |
Our promises on safety and personal data
| Promise | How it is kept |
|---|---|
| Only you link your account | Link codes bind their issuer. No linking on someone's behalf exists |
| Unlinked gets nothing | Only linked:false is returned; no delegation is minted |
| Identity from your system | A userId in a body is refused or ignored |
| Tokens stay in their app | Delegation and approval tokens go only to the issuing app |
| Email is notify-only | No linking, approving or AI use |
| Promise | How it is kept |
|---|---|
| No secrets on screen | The admin token lives in the gateway's memory only; tokens stored hashed |
| Dangerous features off | Plugin management, terminal and coding features disabled |
| Personal bots for their owner | Create-only; lookups apply the owner rule per bot |
| Persona never changes rules | Fixed rules come first; rule-breaking wording refused on save |
| No personal data in memory | Double-screened before saving; not saved if a check is unreachable |
Countering AI-specific risks
Injected instructions
Trigger data, attachments, memory and profile are marked as reference, not instructions. Rights, recipients and approvals never change by text.
Exceeding rights
Delegation = AI allow-list ∩ the user's role. Writes are proposals only.
Leaking by choosing recipients
No tool can name a target. Only your system decides recipients.
Personal data in generated text
Typed parameters, screening before sending (amounts, names, contacts, health words) and fixed text.
Runaway unattended work
Denied by default. Delegation classes set explicitly by you. Once per event.
Data sent to the model
Conversations, business data within the user's rights and attachments go to the model provider you choose (always shown for attachments).