Letting an AI agent touch real customer accounts is a trust decision, not a capability decision. Kaarna’s answer is structural: independent supervisors, mechanical gates, and a trace of everything — guarantees written in code, never in a prompt.
Supervisors are separate models with one job: judging. They don’t share the generator’s context or its blind spots. If a supervisor fails, the system fails closed — the message is held and a human steps in. Never the other way around.
Tool permissions are enforced in the executor — code that runs the same way every time — not by asking the model nicely.
Look up an order, check a subscription. Executes freely, always recorded.
Update a case, add a note. Requires explicit customer confirmation in-conversation; the undo path is registered before the tool can ship.
Issue a refund, cancel an order. Customer confirmation and a supervisor verdict and — when your policy demands it — a human approval, with the approver’s identity on record.
Plans, model calls, retrievals, tool executions, supervisor verdicts — an append-only trace per conversation. Reconstruct exactly why the agent did what it did, months later.
Grounded mode requires every factual claim to cite an ingested, versioned knowledge chunk. No citation, no claim — the message is blocked and replanned, not “probably fine.”
A technical brief on supervision, tracing, and data handling, written for your security and compliance review.
Request the security brief