How Actum keeps actions governed

Scoped tool access, policy levels, and human approval for writes.

This page describes how Actum governs actions. It does not claim compliance certifications. Security review requests are welcome.

Workspace separation

Access is scoped to each workspace. Details of data separation between workspaces are available on request.

Connections and authorisation

Tools are granted explicitly, not by default. CRM, calendar, email, and payment connections are not connected yet.

Permission levels

Each action is assigned a policy level: Automatic, Confirmation, or Protected. No write tools are connected today; when they are, Confirmation and Protected actions will wait for a person.

Approvals

Approvals show the proposed action and its impact before anyone confirms it. Approvals reduce risk; they do not guarantee outcomes.

Credentials and data

Please do not share account passwords or payment card details in chat. Data handling and secret-storage details are available on request.

Audit trail

Every agent run is saved with its outcome and the checks it passed or failed.

Retention

Retention terms for workspace data are available on request.

Access controls

Agents and their runs are private to the account that owns them.

Prompt injection

Prompt injection through customer messages or tool output is a known risk for AI agents. Agents currently have no write access to business systems, and we welcome security review of these controls.

Security contact