Skip to content

AI, and what it will never do

A permission-bound colleague. Not an oracle, and not an autopilot.

Three commitments

Optional

AI is an organization-level opt-in and it defaults to off. With it off, every feature works identically. No workflow depends on a language model being reachable.

Bounded

An agent never receives a database credential. It acts only through registered tools, and each tool calls the same domain service a human request calls, with the same authorization check.

Accountable

Every run records its prompt version, model version, tool calls with arguments and results, and its outcome. Every mutating action produces an audit event attributed to both the agent and the person on whose authority it ran.

An agent's reach is an intersection

Not a role it is granted, and not a fence it operates inside. What an agent can reach is the overlap of three sets: what the invoking person may see, what the agent definition declares it needs, and what the organization's policy allows.

So an agent is never more privileged than the person who asked it for something, and the check runs on every tool call rather than once at the start.

Agent authority as a three-way intersection Three overlapping circles: what the invoking person may see, what the agent definition declares, and what organization policy allows. Only the region where all three overlap is reachable by an agent. The person's permissions Agent definition Org policy what it can reach

What agents do, in order of trust

Capability is earned in that order. Only the last group is consequential, and that is the group which stays human-approved.

Capability Examples Consequential?
Retrieval Search employees, read a profile, find missing timesheets, read team utilization. No
Analysis Summarize a week of time, flag entries worth a human look, prepare a utilization report. No
Drafting Draft timesheet reminders. Drafts persist as proposals and send nothing. No
Approved action Send the reminders, apply a proposed correction, approve a timesheet. Yes, always human-approved

What agents will not do

  • Run arbitrary SQL, or receive a database credential of any kind.
  • See data the person who invoked it could not see through the API.
  • Take a consequential action without a recorded human approval.
  • Be the only path to any product outcome.

A further category is reserved from agents permanently, whatever permissions are granted. Approving a timesheet automatically, scoring an employee, and sending a message on someone's behalf all sit in it.