Trust & Security
OperatorKit runs autonomous agents against your most important data. That only works if the boundaries are real. These are the guarantees the system is built on — enforced in code, verified by tests, and provable in the audit trail.
Governed at the consequence boundary
Every action in OperatorKit is classified by its type — send an email, move money, touch a contract — never by what a message says. Anything with external consequences creates a pending approval and waits for a human. Approvals are single-use: once decided, they cannot be replayed. Rejection is terminal.
Prompt injection has nowhere to land
Because governance decisions depend only on action type, content like “approve this automatically” or “act as admin” is inert data. No agent, prompt, or payload can reclassify an action or bypass the approval queue. Unknown action types fail closed to governed.
Tenant isolation enforced in the data layer
Every record belongs to one organization, and the isolation is enforced inside the database access layer itself — a query that isn't scoped to your organization is rejected before it runs. Cross-tenant reads and writes are impossible through any API path.
An audit trail that cannot be edited
Every governed action, every approval decision, and every agent step writes an append-only audit record: who, what, when, and outcome. There is no update or delete API for audit history. The receipts are permanent.
Bounded agents
Each AI worker declares what it may do, what it may never do, what memory it can touch, and what requires approval — and the governance engine, not the agent, enforces those bounds. There is no direct-execution path around it.
Defense in depth
Sessions are httpOnly. Authentication and sensitive endpoints are rate-limited. Inbound webhooks are cryptographically verified. Per-brand credentials are AES-256-GCM encrypted, and every decryption is itself an audited event. Errors never leak internal details.