Manifesto
The agent
you hand keys to
A chat answers questions. An agent works: it reads the customer base, edits deals, writes mail on the company's behalf and reports the numbers decisions are made on. It should be held to the standard of a staff member with keys.
- 08 rules
- a mechanism under each
- open text
Take this text whole or in parts for your own product. No credit required: the rules are worth more than the authorship.
01 / Why this exists
An AI agent is
access you granted,
not one more subscription
A language model on its own is harmless: it talks. An agent is that same model handed the keys to the CRM, the mailbox, the phone system and the ad account. At that moment the conversation ends and work inside the company begins.
The market sells agents as a chat with a monthly fee, so the discussion is about price and the number of integrations. We think that is the wrong question. Next to «what will it do without asking», «where does the data go» and «how will I know the number is incomplete», price comes second. Answers to those are not written in a product description: they are either built into the thing or they are absent.
We are putting our rules in writing so that they can be held against us. Each one is backed by a mechanism: code, a test, or a log on your side. A rule without a mechanism is not a promise but an advertisement, and we do not write those.
02 / Principles
Eight rules
The order is deliberate: what cannot be repaired after the fact comes first. Under each rule sits the mechanism that holds it up and a way to check it without us.
-
01
Nothing irreversible in silence
Sending mail, editing a deal, spending money, publishing: the agent shows the whole thing before it happens and waits for a yes. Consent is single use, permission for this letter does not carry to the next one. It reads on its own, it changes things only together with a person.
- mechanism
- Dangerous actions are a separate list in the core and always route to confirmation
- check it yourself
- Ask it to send an email: it shows the text and stops
-
02
The data stays with its owner
The agent runs on your machine or in its own cell on a server. The only outbound requests go to the services you connected yourself. There is no telemetry in the code - not a promise not to collect, but the absence of anything to collect with.
- mechanism
- Runs on your machine, outbound requests only to connected services
- check it yourself
- Search the sources and watch the network log on the agent's machine
-
03
A number arrives with its source
The answer names the system, the period and the counting method. A number without an origin is an opinion, and you cannot decide on it. The same leads counted three ways give three different results, and the client should see that gap, not only the person who counted.
- mechanism
- The connector attaches source, period and method, not the model
- check it yourself
- Ask «where is this number from» after any answer
-
04
Incompleteness is said out loud
If a service claims five hundred records and hands over four hundred and eighty, the agent says so before the number reaches a report. A silent shortfall is worse than an error: errors get noticed, missing rows do not.
- mechanism
- The connector compares the record count a service claims with what it delivered
- check it yourself
- Compare the agent's answer with an export for the same period
-
05
«Not enough data» is a valid answer
When the systems hold no answer, the agent says exactly that instead of supplying a plausible number. Plausible is worse than empty: an empty spot gets questioned, a plausible one travels into a deck as fact.
- mechanism
- The answer is assembled from what the systems returned, not completed by the model
- check it yourself
- Ask for something the connected systems do not hold
-
06
A capability exists where a test exists
A capability is real if breaking it breaks a test. A line in the docs, a comment in the code and a slide in a deck are not capabilities. We have caught the opposite in our own work and treat it as a defect, not a detail.
- mechanism
- 910 tests, each about a specific way to lose data
- check it yourself
- Run the test suite yourself after installing
-
07
What it did is visible
Every action stays in a log on your side: which request, to which system, what came back. The agent's work can be audited without us - including after you leave us.
- mechanism
- The request and response log is written on your side
- check it yourself
- Open yesterday's log
-
08
A person carries the responsibility
The agent prepares a decision, it does not make one. The person answers for the letter that went out, the document that was signed and the number in the report. Selling anything else means selling a release from responsibility that does not exist.
- mechanism
- Automatic execution of dangerous actions is off, consent is single use
- check it yourself
- Try granting blanket permission in advance: there is no such mode
03 / Limits
What we do not promise
Without this part a manifesto turns into marketing. Here is what the agent does not do, and we are not going to pretend otherwise.
- We do not promise the agent will not be wrong. We promise the error will be named and findable in the log, instead of surfacing a quarter later inside someone else's report.
- We do not promise a replacement for staff. It takes the repeating work: summaries, reconciliations, lookups across systems. The decision stays with a person, and we price it against the routine removed, not against people let go.
- We do not promise work without a model. A language model runs inside, it has a name, a price per request and a ceiling. We name all three before the contract, not after the first invoice.
- We do not promise any system connected in a day. Every connector is written around the specific ways that specific service loses data quietly. Skip that and you get a confident answer built on nothing.
04 / Next
Hold the rules against your own data
Take the question your team currently answers by hand and put it to the agent. The answer comes back with a source, a period and an honest caveat wherever the data ran out.