Safety and control

Crewdesk can send e-mail, change records, run automations, edit code and deploy. Its safety model is built on one idea: reads are free, writes are yours to approve, and everything it does is recorded and reversible where it can be.

The layers

Layer	What it does	Page
Permission modes	How much the agent may do on its own in a folder	Permission modes
Approval cards	Writes proposed with their exact inputs, run only on your yes	Approval cards
Organization policy	Rules your admins set for everyone, enforced by the server	Organization policy
Sandbox	Commands confined to the folder; credentials out of reach	Sandbox and secrets
Secret scanning	Credentials kept out of everything the agent writes	Sandbox and secrets
Untrusted data	Outside content is data, never instructions	Untrusted data
Claims checking	The reply's claims checked against what the tools returned	Claims checking
Stop all and Activity	A kill switch, and a record of what was done	Stop all and Activity
Devices and tokens	Sign-ins that expire, rotate and can be revoked	Devices and tokens

Where things are enforced

The Hub (the Crewdesk server) is authoritative. It holds every credential, and it re-checks every write the brain asks for against your permissions and your organization's policy, whatever the brain decided. A check that fails to run refuses the write rather than letting it through. The brain is tested never to read the Hub's secrets.

Other limits

• Usage limits per user (by default 2 turns at once, 30 turns an hour and a daily token budget), adjustable by the server's operator.
• Web guard: fetches and downloads go over https to public addresses only, with every redirect re-checked.
• Audit: an append-only log of every write, run, deploy, approval and refusal, kept for 180 days.
• No content in logs: the text of your messages and the replies isn't written to the server's logs.
• Consent: a versioned statement of what is kept and where, accepted before the first chat.