Agents that act with receipts
An agent that can move a deal or send a campaign is only worth having if it can’t do anything the person asking couldn’t do by hand, and if every action it takes leaves a trail. Here’s how that gate works.
An agent in Amolfi can move a deal, send a campaign, or rewrite a record. It does every one of those things through the same doors a person uses, under the name of the person who asked, and the costly ones stop and wait for a human to say yes. Anything that can act can also act wrongly, and the design is arranged around the morning that happens.
An agent gets no private entrance
Agents in Amolfi don’t write to the database. When one updates a record, it goes through the same action handler that fires when a person clicks the button in the interface, and it runs as the person who asked for it. That one decision settles most of the argument before it starts. An agent inherits your permissions and nothing past them. It stays inside your workspace, held there by the same walls that keep every other company’s data away from yours. It meets the same validation your own edits meet. No separate path was built for an agent to slip through.
From there, every action an agent can take is sorted by what a mistake would cost.
- Questions run straight through. Asking for last quarter’s numbers changes nothing, so nothing waits.
- Low-risk writes follow whatever the owner has chosen. They can show you a preview and hold for a yes, or they can run on their own, never reaching past the level of risk that owner allowed them to reach.
- High-risk work becomes an approval card. Money moving, anything headed out of the building, and the run stops on an owner’s desk.
- Every run leaves a receipt. Who asked, what ran, what it touched. None of it is anonymous.
The approval card carries one rule that holds without exception: an agent cannot approve its own. However sure it is, however routine the request looks, that run sits and waits for a human to say yes.
What you end up with is an agent that moves at full speed wherever speed costs nothing. It can answer questions all afternoon without checking in with anybody, because answering leaves nothing to undo.
The part that earns its keep shows up later, on the day somebody asks why a deal moved last Tuesday. You don’t get a shrug about what the AI decided. You get the name of the person who asked, the action that ran, and the record it touched.