An agent that can do things is only safe if three questions have clear answers: whose permissions is it using, what can it do without asking, and how do you find out what it did. Those three answers are the design.
An agent operates inside the permissions of the person it acts for. It cannot reach a record that person could not open, and it cannot be configured to.
Consequential actions are proposed rather than executed. A person reviews the drafted action, edits it if needed, and accepts or rejects it.
A daily execution quota is enforced on the server, not in the interface. A misbehaving agent runs out of budget rather than running unchecked.
Everything an agent produces is attributed back to the artifact it created and the record it touched, so the trail is complete.
The value is in the work nobody wants to do and everybody forgets.
An inbound message arrives on a personal line, the agent drafts a response grounded in the record it belongs to, and the person sends or edits it.
Sorting what needs a human today from what can wait, using the same data the person would have looked at.
Chasing the thing that was supposed to happen on Thursday, and proposing the follow-up rather than silently sending it.
Users rate agent output, and those ratings feed back into how suggestions are ranked rather than disappearing.
Consequential actions go to an approval queue. What counts as consequential is configurable, and the conservative default is that anything leaving the system is reviewed.
The permissions of the person it acts for, and only those. There is no elevated agent identity.
A daily execution quota enforced server-side, plus the fact that meaningful actions require human acceptance.
Create an account, explore the full builder console, and launch your first application on a custom domain. Nothing is charged while your application is still in development.
No credit card required. The console preview, the documentation, and the architecture reference are all readable before you sign up.
Get started free Read the docsUniversal Inbox brings work needing attention into one place while conversations, form submissions and business records remain their original sources. Refresh a changed item before approving an action. GoClaw research and planning are read-only; material changes require the configured approval policy and permission for the specific action.
Read the guideAI search and Knowledge Core use the current user’s record, field, DataRole, location and AI-read permissions before assembling context. Multimodal retrieval can retain document text and visual evidence. Model serving, ingestion and execution workers must be configured and enabled; seeing an AI control does not establish that a provider or worker is running.
Read the guide