The model never writes a row
Everything the AI operator can change is a typed proposal. Python carries it out through the same code the screens use — the model only asks.
- 51 tools, filtered by your permissions first
- Before the model is shown a single tool, the list is filtered against the signed-in user's own permissions out of 157. A tool with no policy entry is dropped rather than allowed, so the operator running for a cashier cannot reach what the cashier cannot reach.
- 26 executors, written by hand
- An approved proposal runs through one of 26 Python executors calling the same serializers the screens call. Same validation, same audit trail, same double-entry — there is no second path into your data.
- The approval card shows the real effect
- Before the card reaches you, the actual executor runs inside a transaction that is then rolled back. The figures you read are what really happened in that throwaway run, not the model describing what it intends to do.