An agent acts alone only when it is safe to.
Every action is classified before it runs, every paid model call is capped, and every decision leaves a record.
Five classes of action
Each tool an agent can call carries a class. A0 runs on its own; A1 to A4 wait for a person, and the policy matrix routes each class to its reviewer. These are the default routes.
A0 · Runs on its own
Low-risk reads.
A1 · Waits for approval
Reads of sensitive data.
A2 · Waits for an operator
Writes made through the browser.
A3 · Waits for a senior approver
Finance submissions, deployments and package changes.
A4 · Waits for the top approver
Break-glass actions, with escalation if nobody answers.
AI spend cannot outrun what you paid for
Model access is decided by your plan and paid for in advance.
A capped key per workspace
Paid models are called with the workspace's own key, capped at its prepaid credit balance.
No cap, no paid models
A paid workspace without a capped key is refused paid models until it has one.
Free stays free
The Free plan is limited to free models, so it never draws on credit.
Evidence by default
Records are kept so that someone who was not there can check what happened.
Append-only audit log
Approvals, gate decisions and admin changes go to a log the database refuses to update or delete. It is kept for 24 months.
Hash-chained action history
Inside each workspace, agent actions are chained by hash per company, so a silent edit breaks the chain.
Append-only credit ledger
Every credit top-up and deduction is a new row. Nothing is overwritten.