01
Human-in-the-loop approval
Critical actions require explicit human sign-off while the gate is on. Every employee starts that way; you decide, per employee, when it may act on its own.
07security & control
Autonomy is earned. Control is default.
A digital employee is only useful if you can trust it on Monday morning. Every implementation runs inside a control layer: scoped permissions, human approval on critical actions for as long as you want it, full audit trails and continuous monitoring.
THE CONTROL LAYER, every action passes these gates before execution
gate 01
Permission check
Is this action inside the employee's defined role and data boundaries? If not, it stops here.
gate 02
Policy & rules
Business rules you set, thresholds, exclusions, escalation triggers, are applied automatically.
gate 03
Human approval
Critical actions, sending, ordering, paying, publishing, wait for an explicit human decision, for as long as that gate is on. You set it per employee.
gate 04
Log & monitor
The action, its inputs and its outcome are logged. Anomalies alert a human and trigger safe fallbacks.
→governance in detail
Twelve commitments, standard in every implementation.
02
Role-based access
The employee holds its own scoped credentials, never a person's account, with least-privilege permissions.
03
Data boundaries
Which data may be read, written or never touched is agreed in writing before integration begins.
04
Logging & audit trails
Every action, input and decision is recorded and reviewable. "What did it do?" always has an exact answer.
05
Continuous monitoring
Performance and behavior are tracked against agreed metrics, with alerts on anything unexpected.
06
Error handling & fallback
When the employee is unsure, it stops and hands over to a human, it never improvises past its confidence.
07
GDPR-conscious implementation
Data minimization, purpose limitation and EU-conscious processing choices are part of the design phase.
08
Clear permissions
You can see, per employee, exactly what it is allowed to do, and change it whenever you want.
09
No uncontrolled autonomy
No digital employee ever takes open-ended autonomous action. Scope is explicit; everything else is out of bounds.
10
Review before critical actions
Payments, orders, publications and outbound messages are always reviewable before they leave the building.
11
Secure integrations
Encrypted connections, scoped tokens, and no credentials stored outside managed secrets.
12
You can see it yourself
You log in to your own dashboard: what the employee did, what it returned, and everything that waited on your decision. Live, not once a month. No black box, and you never have to ask us.
What we do not promise: that a language model is never wrong. It can be. What these twelve are for is that it can never act on being wrong unnoticed, the gates, the logs and the stop button exist precisely because the model is fallible.
→common questions
Asked in almost every first call.
Can the digital employee act without anyone knowing?+
No. Every action is logged, and critical actions require explicit approval before execution as long as you keep that gate on. Switching it off is your call, per employee, and it never changes what gets logged. You can review the full activity trail at any moment, and monitoring alerts a human when anything falls outside expected behavior.
Who controls what it's allowed to do?+
You do. The role, permissions and data boundaries are agreed during design and remain yours to change. Expanding autonomy is always your decision, based on results, never a default.
What happens when it encounters something it doesn't understand?+
It stops and escalates. Uncertain cases are routed to a human with full context. That handover behavior is designed and tested before go-live, not improvised in production.
How do you handle our customer data?+
With data minimization by design: the employee accesses only the data its workflow requires, within agreed boundaries, over encrypted connections. GDPR considerations are addressed in the design phase and documented per implementation.
Can we shut it down instantly?+
Yes. Every digital employee has a stop mechanism that pauses all activity immediately, with work safely queued for human handling. Nothing about the setup locks you in technically.