Be specific.
Define boundaries around people, teams, tools, and actions. Make Salesforce read-only while allowing a new account with manager approval.
Delegate the work.
Keep the control.
Set what AI employees can do, who approves, and where data lives.
Policies for everyday work
Rule: “Ask before deleting anything.”
Attempt in Google Drive: Delete “Q3 forecast”
Result: Needs approval
Rule: “Only talk to John, Dan and the Marketing team.”
Attempt in Slack: Reply in #marketing
Result: Allowed
Rule: “Managers approve new Salesforce accounts.”
Attempt in Salesforce: Create Northwind account
Result: Needs approval
Rule: “Never email anyone outside the company.”
Attempt in Gmail: Email jane@northwind.com
Result: Blocked
Keep decisions with you.
Require approval for sensitive actions. An employee can prepare a change and ask before carrying it out.
See what happened.
Review governance decisions and approvals in the audit history, so you can understand how your rules applied.
One click.
Exactly the reach you mean.
Approve once, for an hour, or for good.
Gmail · Send email
WaitingHigh risk
Ava asked 4m ago in Slack · 23h 56m left
- To
- cfo@northwind.com
- Subject
- Q3 renewal terms
- Body
Hi Maya, attached are the Q3 renewal terms we discussed. The pricing sheet covers all three tiers. Happy to walk through it on Thursday.
External recipient and an attached pricing file.
Runs this one call. Nothing is remembered: the next one asks again.
Adds a temporary allow rule for
gmail_send_emailthat expires in an hour.Adds a permanent allow rule for
gmail_send_emailto Ava’s rules. Revoke it any time in Permissions.Blocks this call and tells Ava why, so it can try another way.
Security your team
can sign off on.
Guardrails
Guardrails from day one
Every organization starts with baseline guardrails. Only an employee’s manager or an admin can add tools or change its policies.
Human approvals
Sensitive actions pause for the manager, who can approve once, allow for a while, allow permanently, or deny.
Kill switch
Say “stop” in the conversation and the running work halts immediately, including tools already in flight.
Prompt-injection protection
Untrusted content from messages, web pages, and tool results can be scored and blocked, flagged, or held for approval.
Access controls
Decide who can reach each employee, internally and externally, from manager-only to specific people and channels.
Spend and rate limits
Hard caps per employee and per scheduled task, daily, weekly, or monthly. At the cap, the employee stops acting.
Security
Encryption
Keys, secrets, and integration credentials are encrypted at rest with AES-256. All data in transit uses TLS.
Immutable audit log
Policy edits, credential operations, role changes, and admin actions are recorded in an append-only log that can’t be edited.
Full provider control
Choose the providers and models behind inference and tooling, pinned per capability, and allow only the ones you approve.
Bring your own keys
Use your own provider credentials for the organization or a single employee, so work runs under your own account and terms.
Multi-cloud & BYOC deployment
Run a dedicated data plane in your own AWS or Google Cloud account. Data stays in your region, with keys you own.
Identity and access
Single sign-on, groups synced from your identity provider, and role-based access for admins, managers, and members.
Multi-cloud operations
under one rulebook.
Native AWS, Google Cloud, and Azure connectors, checked by the same CEL policies.
Amazon Web Services
Read logs
CloudWatch logs, metrics, and alarms.
Inspect workloads
EKS, ECS, EC2, RDS, and Lambda.
Manage resources
Start, stop, or reboot EC2 and RDS.
Google Cloud
Read logs
Cloud Logging, metrics, and alert policies.
Inspect workloads
GKE, Cloud Run, and Compute Engine.
Manage resources
Start, stop, or reset VMs.
Microsoft Azure
Read logs
Log Analytics queries, metrics, and alerts.
Inspect workloads
AKS, VMs, Container Apps, and Functions.
Manage resources
Start, stop, or restart VMs.
What would you hand over first?
Start with one role and one real task.