Why we made it impossible for your crew to send, spend, delete, or deploy alone

The scariest sentence in AI right now is "it did that on its own." Give a crew of agents the ability to find contacts and email them, and you've also given it the ability to spam a thousand strangers before lunch. Give it the ability to delete, spend, or reconfigure infrastructure, and one bad prompt or one adversarial input is all it takes to turn a productivity tool into an incident.

So we drew a line, and we built it into the code path instead of a setting. Four categories of action — external communication, money and contracts, code and infrastructure, and irreversible deletes — always require a human decision. Not "by default." Not "unless you turn Auto Mode on." Always.

Autonomy where it's safe, a human where it isn't

Your crew still plans, researches, drafts, and prepares constantly without asking permission for every step — that's most of what makes it useful. Auto Mode governs how much of that low-risk, internal work runs unattended. But the four hard-gated classes sit below that setting entirely. There's no toggle that lets an email actually leave, a dollar actually move, code actually deploy, or a record actually vanish without someone reading it first.

In practice, outreach looks like this: an agent researches a prospect and drafts an email in your crew's voice. It lands in a review queue. A human reads it and clicks send. Even then, a warmup cap limits how many go out from a new sending domain in a day, so a new instance never looks like a spam operation to an inbox provider.

We test the failure modes, not just the happy path

Anyone can demo an agent behaving well. The question that matters is what happens when it doesn't. Before every release we run a small adversarial test suite — scripted models that actively try to get around the gates, not models trying to be helpful.

• Spam a hard gate under Auto Mode, over and over. Every attempt stays queued for a human. Zero executed.
• Claim an email was sent in the same breath as only queuing it for approval. The outreach never goes out — the claim doesn't make it true.
• Assert an action happened with no real tool call behind it at all. Zero proposals get created. A bare claim does nothing.

A hard gate that a good-enough prompt can talk its way around isn't a safety feature. It's a suggestion.

Why this is the differentiator we lead with

Some AI sales tools will find companies, find contacts, and email them completely autonomously, at scale, with no one in the loop. That's a real capability — and a real liability. We'd rather you never have to wonder whether your crew spammed someone, committed you to a contract, or deleted something important while you were asleep. Autonomous, never reckless, is the whole design decision.