AI that cannot write without your approval
Updated
In short
Can an AI assistant be safe to use inside a regulated institution?
In Kelvyn the assistant reads freely and writes never — not without an explicit approval. Every mutating operation in a turn is collected into a single approval card with a preview of each operation, and only what you approve and what is still valid executes. That holds in all three autonomy modes, including the most autonomous one. Signature actions are refused to the assistant outright, every action is logged with both the acting and the effective identity, and writes can be undone individually.
The write gate
A turn runs read-only tools immediately, because reading is not a risk worth a dialog. Every tool that would change something is held, collected, and presented as one batch approval with a per-operation preview. Execution covers the intersection of what was approved and what is still valid at execution time.
The autonomy setting governs planning, not writing. The two were deliberately decoupled so that turning autonomy up does not, as a side effect, turn the write gate off.
Some things the assistant cannot do at all
Signature actions — board votes, approvals, sign-offs — are refused to the assistant entirely, and refused under impersonation. They require the officer's own session and their own business role, across 27 governed signature actions.
The consequence is worth stating plainly: a system administrator cannot sign a board vote, and neither can an AI acting for one.
Numbers are checked, and the check is shown
Every tool call emits a source citation. Currency, percentage and multiplier figures in the narrative are checked against that turn's tool results at display precision, and the count of figures traced is shown to the user rather than kept in a log.
The measure catalogue refuses to substitute. Ask for book value and you get the stored amortised-cost actual or an honest decline — never face value or price paid dressed up as book value.
Attribution survives impersonation
Audit rows carry both the acting user and the impersonation session where one applies, so support access is attributable rather than anonymous. The analytics surface is isolated from action tools regardless of the stored conversation type, so a read-only surface stays read-only.
Scope
What this does not do
Not every figure is traced. Bare counts and years are excluded by design, and qualitative prose is not traced at all. A figure that cannot be resolved is annotated as unresolved — it is not blocked.
The deterministic output verifier for chat runs in shadow mode: it logs findings and does not suppress a result. The continuous-monitoring digests are the opposite — those are enforced from the start and are suppressed outright if any numeric check fails.
Immutable stress runs have no undo. Per-tool undo covers writes generally, but an append that was designed never to be reversed is not reversed.
Questions
- Can the assistant change data on its own?
- No. Every mutating operation waits for explicit approval in all three autonomy modes, with a preview of each operation before you approve it.
- Can the AI approve a board resolution?
- No. Signature actions require the officer's own session and business role and are refused under impersonation. There are 27 such governed actions.
- How do we know a number in an answer is real?
- Each tool call emits a source citation, and currency, percentage and multiplier figures are checked against the turn's tool results at display precision, with the number of traced figures shown to you. Bare counts, years and qualitative statements are outside that check.
Related