About
Most AI products stop at the answer.
Asking which invoices are overdue and getting seventeen is useful, and the work is still entirely yours. The interesting problem is everything after the answer — and almost all of that problem is about limits.
An agent that could actually chase those seventeen invoices needs rather more than intelligence. It needs to know which ones are safe to contact and which are delicate. It needs to send from your address without being handed your mailbox. It needs to stop at the point where a human judgement is genuinely required, and it needs somebody to stop at.
The shortcut is well known and it is what most of this category currently does: give a model an API key with broad access, write careful instructions, and hope. That fails in a specific and predictable way. The instructions are a request rather than a limit. Nobody can tell afterwards which agent acted, because the audit log recorded the key. Revoking the key breaks everything else using it, so nobody revokes it.
So this platform is built the other way round. An agent has an identity of its own, so you can tell what acted. It holds narrow capabilities rather than credentials, so there is something specific to review and revoke. Its authority is checked separately from its capability, so holding the tool that changes a price does not mean being allowed to offer any price. And when it reaches the edge of that authority it asks a named person, with the evidence attached.
None of that is glamorous to build and it is the entire reason an agent here can be pointed at a finance process. The unglamorous part is the product.
What we believe
Six decisions that shaped this.
Each of these rules something out, which is the only reason any of them is worth stating.
Give agents tools, not your keys
Every design decision here comes back to this one. An agent gets narrow, named capabilities it was granted — never a credential, a connection string or an administrative key. The shortcut is faster to build and it makes every other control on the platform decorative.
A prompt is not a control
Anything enforced only by instructing a model carefully is a request, not a limit. Refusals happen at the capability, after the model has decided to try. Any platform where a well-written email can widen an agent's behaviour has no security model, whatever its documentation says.
Nothing acts without an owner
The deploy button is disabled until a person or a role is accountable. An agent nobody will claim is the specific failure this product exists to prevent, and it is how companies end up with something acting on their behalf that outlived whoever built it.
Some things are not a setting
Refunds, deletions, permission changes and contract issuance are refused to every agent on every plan. Not offered as a configuration for advanced customers, not unlockable by an enterprise agreement. If a limit can be lifted under commercial pressure, it was never a limit.
Exceptions are the product
214 invoices checked, three need you. The point of an agent is to reduce work, not to produce another dashboard to check — so the default view is the small number of things that need a person, and silence is a valid morning.
Say where it stops
Every feature page on this site names what the feature does not do. We do not make you compliant with anything, cannot undo a sent email, and cannot tell you whether a job is a good idea for an agent. Saying so is more useful than a capability list you have to test to disbelieve.
The measure
One sentence we want to hear from a customer.
“It completed useful work, and it stayed inside the rules I gave it.”
That is the moment worth optimising for, and it is not the moment somebody creates an agent. A created agent is a configuration screen. The thing that changes how an owner thinks is reading a run three days later, seeing that it handled two hundred items and escalated three, and agreeing with all three.
The second moment, usually a few weeks in, is noticing that the agent asked about something you had not thought to make a rule for.
Questions, disagreements and requests all go to [email protected], and they reach a person.
Give AI a job.
Build an agent, choose what it can access, define what it may do, and deploy it to work safely across your business.
No code required · Full SDKs and API · Stop any agent instantly · [email protected]