00 Trust
How far it goes, and who decides that.
Letting software act on your business is a reasonable thing to be careful about. This page is the long version of the answer, because the short version belongs on the homepage and the long version is what you actually need before you let anything near a customer.
The short version of the long version: it starts able to do nothing on its own, and the only thing that changes that is you, one lane at a time, after it has earned that lane.
01 The gate
It starts with nothing moving without you.
Email, postcards, anything at all that reaches a customer, stages to an inbox and waits there. It does not time out and go anyway. It does not send because you were slow. It sits until you act on it, and you act on it one item at a time. That is where every agent begins, and it is where an agent stays in any lane you have not opened.
The inbox is sorted by what it costs you to ignore, not by when it arrived, because a quote going cold matters more than a tidy queue. Each item shows you the whole thing it wants to send, not a summary of it, so approving is reading rather than trusting.
Approve it. Edit it first. Or skip it.
Skipping is a real answer and it is recorded as one. An agent that keeps having its suggestions skipped in a particular area is an agent whose playbook is wrong, and the product treats that as information about itself rather than as a user error.
02 The freeze
What you approved is what sends.
An approval is worth nothing if the thing you approved can change afterwards. So it cannot.
The content is frozen on decision
At the moment you approve, the exact bytes of what you read are fixed. Editing that item afterwards and expecting it to still go out under your approval is refused by the database, not by a rule somebody remembered to write in the application.
A stale approval is refused
If the content changed between the moment it was shown to you and the moment the approval lands, the send is refused rather than guessed at. You get asked again, against what it actually says now.
Anything it can do on its own has a written way back first
An action does not get to run unattended until the reverse of that action exists and has been written down. That ordering is the rule: the undo is built before the do.
Anything the AI writes as a page cannot reach the network
When an agent produces a report or a dashboard as markup, that markup renders sealed off. It cannot fetch anything, call anywhere, or touch your session. It can only ever draw rows the person looking at it was already allowed to see.
03 Being wrong
It is not allowed to be the source of a number.
Confident invention is the failure everybody has read about, and no model is immune to it. What can be designed is where a model is permitted to be the authority, and on figures the answer here is nowhere.
Ask for a dashboard and you do not get a page with numbers typed into it. You get a set of questions the app asks your own records every time somebody opens it, under that person's own permissions. Two people opening the same board see their own data, and neither of them sees a figure the model remembered.
That design came out of getting it wrong. The first version wrote the counts into the page itself and one of them was badly off. A page that stores an answer will eventually store a stale one, so now it stores the question instead.
A page that stores an answer will eventually store a stale one.
The same rule runs underneath quoting. An agent picks the item and the quantity, and what that costs comes from your price list rather than from the agent. Anything it picks that your catalogue does not recognise is marked as unpriced, with the reason, instead of quietly adding nothing to the total.
And the rest is containment
Where a model does write prose, four things sit around it. Agents are told to say when they could not confirm something rather than fill the gap, and that line lands on the record alongside everything they did confirm. Work that comes back thin is sent back for another pass before it reaches you. A sweep re reads what was produced earlier and raises anything it is no longer confident about as a question. And nothing outward moves without you, which means a wrong answer meets you first rather than meeting your customer.
Nobody can promise a model will not be wrong. This is built so that being wrong is survivable, visible, and yours to catch.
04 The record
You can read back what it did.
Most software will tell you that something happened. This tells you why. Open any run and you get four things in plain language: what the agent was told to do, what it went and looked at, which tools it called and with what, and what it actually changed or produced.
That matters most on the day something is wrong. The difference between a fact it holds being wrong and a playbook being wrong is the difference between a correction that takes a second and a change that takes an afternoon, and the trace is how you tell which one you are looking at.
It also grades its own work. A sweep re reads what the agents produced earlier, and anything it is no longer confident about comes back to you as a question rather than sitting there being quietly wrong.
- Told. Check quotes with no reply and prepare a follow up.
- Saw. The quote record, the thread, the last contact date, the job it belongs to.
- Called. Read the record. Drafted an email. Staged it.
- Did. Wrote a draft and attached it. Sent nothing.
05 The ladder
It earns its way up.
Approving everything forever would be its own kind of work. So the amount you approve is meant to shrink, one grant at a time, and you are the one making every grant.
Setting up
It is learning the business. It is not acting on anything.
Advised
It tells you what it thinks. You do all of it.
Assisted
It drafts the work. You approve each piece before anything moves.
Supervised
It acts inside lanes you granted, and you review afterwards rather than before.
Delegated
It runs a lane on its own, inside the windows and the caps you set on it.
A promotion is a thing you grant, not a thing that happens. It is proposed on the strength of a track record you can go and look at, and you can take it back.
06 Access
The AI is held to the same standard as a person.
When you add someone to the team, they see the records, the stages and the agents you granted them and nothing else. That is ordinary. What is less ordinary is that an agent is onboarded the same way rather than simply inheriting whatever the person who set it up can reach.
An agent has the fields it is allowed to read and the fields it is allowed to write. Both are refused unless you allowed them, rather than allowed unless you thought to forbid them. And every write it makes is kept next to what the value was before it, so a change is always a thing you can look at rather than a thing you have to reconstruct.
Draft by machine. Approved by a human.
Come and try to break it.
The fastest way to judge any of this is to sit with it against your own records and try to make it do something you did not sanction. We would rather you did that on a call with us than wonder about it.