Letting AI act safely needs one audit log, not five

Answering a question wrong wastes a minute. Taking an action wrong sends the email, moves the deal, refunds the invoice. The gap between generative AI and agentic AI is the gap between being unhelpful and being dangerous — and most of the work of closing it safely happens below the model.

Cyril is built for agents to take actions on your behalf. That only works if every action runs through the same three things a human action does: a permission check, an audit record, and a way to undo it.

The problem with actions across five tools

In a stitched-together stack, an agent that acts has to act through integrations. It creates the project in one tool, sends the email through another, updates the deal in a third. Each has its own permission model, its own (or no) audit trail, and no shared notion of "undo."

So when something goes wrong — and with agents, something will — you're left reconstructing what happened from five partial logs that don't share an ID, a clock, or a vocabulary. You can't answer the only question that matters: what did the agent do, on whose authority, and how do I reverse it?

That's not a model-safety problem. It's an architecture problem, and a guardrail prompt can't fix it.

One permission model

In Cyril, an agent is a caller, not a god mode. It acts inside the same RBAC that governs people: scoped to an org_id, bounded by a role, allowed exactly the permissions in its grant — no more. An agent asked to do something outside its permissions is refused the same way a user would be, by the same code path.

This matters because it makes agent authority legible. "What can this agent do?" has the same answer shape as "what can this person do?" — and you set it in the same place.

One audit log

Every action — human or agent — writes to one audit trail, with the actor, the authority it acted under, the before-and-after, and a timestamp from one clock. An agent action is tagged as such, so "show me everything the assistant did to the Phoenix account last week" is one query, not a forensic reconstruction across systems.

When the actions and the records live on one graph, the audit log isn't a bolt-on. It's a natural read over the same data.

One rollback path

Because mutations are transactional and tenant data is soft-deleted rather than destroyed, an agent's action has a defined inverse. A wrong move is a recoverable move. The same property that protects you from a bad human click protects you from a bad agent step — there's no separate, riskier "AI write" route that skips the safety rails.

Human-in-the-loop is a setting, not a rewrite

Some actions should just happen; some should wait for a person. Because every action runs through one pipeline, "require approval" is a policy you apply to an action class — not a feature you have to re-engineer per integration. You decide how much rope the agent gets, per action, and change your mind without touching the agent.

What this looks like for you

• Let an agent run a multi-step workflow across modules and see exactly what it did, in one log, under one identity.
• Give it real authority without giving it unbounded authority — same roles, same scoping as your team.
• Undo a wrong step the same way you'd undo any step, because there was never a second, weaker write path.

Trustworthy AI action isn't mostly about the prompt. It's about whether the platform underneath can answer for what the agent did. Cyril is built so it always can.

If you'd like to be among the first to use Cyril, join the waitlist.