Letting AI act safely needs one audit log, not five

Answering a question wrong wastes a minute. Taking an action wrong sends the email, moves the deal, refunds the invoice. The gap between generative AI and agentic AI is the gap between being unhelpful and being dangerous — and most of the work of closing it safely happens below the model.

Cyril is built for agents to take actions on your behalf. That only works if every action passes a permission check, waits for a person’s approval and leaves a record of what it did.

The problem with actions across five tools

In a stitched-together stack, an agent that acts has to act through integrations. It creates the project in one tool, sends the email through another, updates the deal in a third. Each has its own permission model, its own (or no) audit trail, and no shared notion of “undo.”

So when something goes wrong — and with agents, something will — you’re left reconstructing what happened from five partial logs that don’t share an ID, a clock, or a vocabulary. You can’t answer the only question that matters: what did the agent do, on whose authority, and how do I reverse it?

That’s not a model-safety problem. It’s an architecture problem, and a guardrail prompt can’t fix it.

One permission model

In Cyril, an agent is a caller, not a god mode. It acts inside the same RBAC that governs people: scoped to an org_id, bounded by the role of the person who asked — no more. Before anything runs, each step of its plan is checked against that person’s permissions on the server, and a step outside them is refused.

This matters because it makes agent authority legible. “What can this agent do?” has the same answer shape as “what can this person do?” — and you set it in the same place.

One record of every run

Every agent run is recorded: the plan, who approved it and what each step did. “What did the assistant do to the Phoenix account last week?” is answered by reading the runs, not by a forensic reconstruction across systems.

When the actions and the records live on one graph, that record isn’t a bolt-on. It’s a natural read over the same data.

Correcting a wrong step

There is no one-click undo for an agent run yet. A record an agent creates or changes can be corrected or deleted like any other, and some steps, such as a reminder already sent, cannot be recalled at all. That is why the plan waits for your approval before anything runs.

Human-in-the-loop by default

Some actions should just happen; some should wait for a person. In Cyril, Ask Cyril shows its whole plan and waits for your approval before any step runs, and you can cancel instead. Approval covers the plan as a whole; you cannot yet set it per action.

What this looks like for you

• Let an agent run a multi-step workflow across modules and see exactly what it did, in one record of the run.
• Give it real authority without giving it unbounded authority — every step checked against the permissions of the person who asked.
• Approve the whole plan before anything runs, instead of finding out afterwards.

Trustworthy AI action isn’t mostly about the prompt. It’s about whether the platform underneath can answer for what the agent did. Cyril is built so it always can.