Felix takes real actions across your business. Here's how every one of them is contained.

Most AI agents are a black box — a request goes in, an action comes out, and you're asked to trust the middle. Felix inverts that. Whatever Felix is doing — answering a customer or running a campaign — it shows its work: how it understood the situation, what it reasoned, what it plans to do, and the exact action it intends to take.

For one-off consequential actions — a customer reply, a refund, an order change — new accounts start in approval-required mode: nothing reaches a customer and no money moves until you approve it. You're not auditing Felix after the fact; you're watching it think before it acts.

For longer-running autonomous work — like a marketing campaign — the approval is at the plan level: you approve the campaign and its budget, and then Felix executes within that approved envelope (see the Executive Services section below). You're approving the mission and the ceiling, not blocking on every single step — but you set the boundaries up front, you can watch it run, and you can stop it instantly.

In both modes, the same thing is true: trust is granted by you, measured by us, and revocable at any moment. As Felix earns a track record on a given type of task, you can let it handle more automatically — on your schedule, never ours. The glass box stays available the whole time.

Felix runs in an isolated cloud environment. It is not software installed on your computer, and it does not have direct access to the files, documents, or sensitive data on your machine. It cannot delete your documents. Its world is bounded to the specific tools and data sources you explicitly connect — your helpdesk inbox, your store, your shipping data — and nothing beyond them.

The honest version of "limited reach": Felix is an agent that does act — it can draft and send emails, propose refunds, and update orders through the integrations you connect. We're not claiming it does nothing consequential. We're saying every consequential action is scoped, visible, and (until earned) approval-gated. That's a stronger guarantee than "it's locked in a box," because it covers the things Felix is actually for.

A "prompt injection" is when someone writes a message crafted to manipulate the AI into ignoring its instructions or acting outside its rules. For a customer-service agent, the input worth thinking about is the one thing you can't control: a message from an anonymous outside person. Felix is built so that such a message is treated as a request to handle, never as a command it must obey.

Felix treats every inbound external message as untrusted by design, and defends in depth so that no single failure point can be manipulated into a breach:

• Layer 1 — The trust boundary. Every inbound customer message is wrapped in explicit untrusted markers before Felix ever reads it, with a hard directive: the text inside is content to act on, never instructions to obey. A customer cannot relax Felix's rules, put it in a "mode," authorize an action, raise its permissions, or make it reveal internal policies, supplier contacts, or another customer's data.
• Layer 2 — The egress guard. Before any customer-facing reply is sent, a separate, independent model checks the finalized draft to confirm it contains only what belongs in a reply to that person — not internal information or anything outside the scope of their request. If something doesn't belong, the reply is quietly replaced with a calm, neutral response. And it's fail-closed: if the guard itself can't run, Felix defaults to the safe response rather than risk shipping something unchecked.
• Layer 3 — The autonomy clamp. Felix flags messages that look like manipulation attempts and clamps its own autonomy — it won't widen its permissions, and side-effecting actions stay gated. On anonymous, interactive web chat, this clamp is sticky: once a session looks hostile, it stays locked down for the rest of that session.

Layer 1 stops the overwhelming majority of manipulation at the door. Layers 2 and 3 are the guarantee for the rare case a model slips. We don't claim injection is impossible — anyone who claims that is one clever message away from being wrong. We claim it's defended in depth, fail-closed, and contained.

The fear here is simple and fair: will it confidently tell my customer something that isn't true?

Felix's answer isn't "it can't" — no honest vendor can promise that. Felix's answer is grounded, judged, and fail-closed:

• Grounded. Felix answers from your actual data and policies — the connected order data, shipping status, and the policies you've written — not from general internet knowledge or guesswork.
• Judged. Before a customer-facing reply is sent, a separate model checks whether every factual claim in the draft (order status, tracking number, ship date, refund terms, prices) is actually supported by the data Felix had. If a claim isn't grounded, the reply doesn't go out as-is. This judge is a different model family from the one that wrote the reply, so it doesn't share the author's blind spots.
• Fail-closed. If that check can't run, Felix doesn't shrug and send anyway. And when Felix genuinely doesn't know, it escalates to a human rather than invent an answer. Saying "let me get a person on this" is a feature, not a failure.

So the claim we stand behind is not "Felix never hallucinates." It's: Felix won't quietly send your customer a made-up answer — because grounded generation, an independent faithfulness check, and a fail-closed escalation path all sit between the model and your customer.

Felix is model-agnostic. It routes across the leading AI models rather than betting your business on a single vendor, and you're free to run the model you trust most.

Here's the important part, and the part most people get backwards: Felix's safety guarantees do not live inside any one model. The glass box, the trust boundary, the egress guard, the faithfulness judge, the autonomy clamp — these are our architecture, sitting around whichever model is in use. They hold regardless of which model generates a given reply. In fact, several of our guards deliberately use a different model to check the work of the model that did the drafting — independence is the point.

Your safety doesn't depend on us — or you — picking the one "safe" model. It's engineered to hold across all of them.

Every AI tool runs on a model provider. Providers go down — routinely. Wired to one, a tool dies with it: your inbox stalls, and you wait on someone else's outage.

Felix runs on many. One stumbles, he's already on another — before you notice. Your customers stay answered. You keep your weekend.

Most AI customer-service tools sell the same promise: connect it, turn it on, let it run. The agent answers tickets, and you find out how it did by checking a dashboard afterward. The pitch is autonomy — hand it off and walk away.

That sounds great until you remember what's being handed off: your customers, your refunds, your brand's voice in writing. With a set-it-and-forget-it agent, you typically learn how a reply landed only after it has already reached your customer — by reviewing it afterward. A log tells you what happened; it doesn't give you the chance to weigh in first.

Felix is built the other way around: you see the work before it reaches your customer, not after. New accounts start with everything held for your approval. As Felix builds a track record on a given type of request, you decide to let it handle those automatically — category by category, and you can tighten it back the moment you want to. Behind that, every reply still passes independent, fail-closed checks before it ships.

The distinction in one line: most agents say "trust it to run on its own." Felix says "watch it earn that trust — and see every consequential action before it sends, until you decide it's earned the right to act on its own."

Everything above applies to customer service. But Felix also does executive work — it runs marketing campaigns, spends ad budget, reaches out to prospects, and analyzes your revenue and margins. This is autonomous work that spends money and contacts people on your behalf, so it gets its own controls, designed for exactly that.

• You approve the plan and the budget — before a cent is spent. Felix doesn't start a campaign on its own. It proposes the campaign — the plan, the audience, the sequence, and the budget — and you approve it. That approval is the authorization, and it defines the envelope Felix works within.
• A hard spending cap, enforced by the system. Every campaign has a budget cap, and spend can only advance while it stays at or under the number you set — it's enforced in the system itself, not a guideline Felix is trusted to follow. And if a job would run past its budget, Felix stops and checks with you rather than continuing.
• Outreach goes to the prospects in a campaign you approved. When Felix runs outreach, it contacts the prospects in the campaign you set up, following the sequence you approved. It personalizes each message, but it isn't cold-emailing strangers off the open internet on its own. Every outbound message runs through the same gated, fail-closed pipeline (including the leak check) as a customer reply, and sends are de-duplicated so no one is ever contacted twice by accident.
• You can stop it at any time. An autonomous campaign isn't a runaway train. You can pause or stop it whenever you want, and billing only ever reflects work actually done.
• Your financial data is protected like your customer data. To do executive work, Felix reads your most commercially sensitive information — revenue, margins, ad performance, your business plan. It lives under the same protections: encrypted, isolated to your account, used to do your work and never to train models, and guarded on the way out by the same check that keeps internal information from leaking into any message Felix sends.

The honest distinction: with customer service, you can approve each reply because they arrive one at a time. A campaign sending dozens of personalized messages over weeks is different — approving every send would defeat the purpose. So the model is different on purpose: approve the mission and the budget, watch it execute, keep a hard ceiling and a stop button. That's the right trust model for autonomous work that spends money, and it's the one Felix uses. We tell you plainly that executive work isn't gated the same way as a single customer reply — because pretending it were wouldn't survive contact with reality, and we don't make claims like that.

Your data is encrypted in transit (every connection between Felix, your store, and your inbox runs over encrypted channels) and encrypted at rest in our infrastructure. Felix runs in an isolated environment per account — one brand's data and another's are never commingled, and Felix only ever works with the accounts you connect. Felix has no access to your local machine and cannot reach anything beyond the integrations you explicitly authorize. Credentials and API keys are held in secured secret storage, never in our application code. And because of the glass box, the people who see your customer interactions are you and your team — Felix surfaces its work to your approval queue, not to a public feed.