The security model
The model as built — each point below is enforced in code, and the confirm flows are covered by tests.
Nothing writes without a human
Every mutating action the AI proposes is staged, shown with the exact target and settings, and waits for a staff Confirm click. Cancels and expiries never execute. The model cannot promote its own proposal to an applied change — only a person can.
The AI acts with your rank, not above it
Tool calls run the same permission gates as the slash commands. The bot checks the asker's Discord permissions and staff rank for every operation — it cannot do something the asking staff member could not do by hand.
Protected targets stay protected
@everyone, managed roles, and setup-critical channels are refused by dedicated guards before any write path reaches them, no matter who asked or how the request was phrased.
Secrets are encrypted, never echoed
Per-guild AI keys are AES-256-GCM encrypted at rest with a key that lives only in the environment. The bot never repeats a key into chat, and the AI is instructed to never ask anyone to paste one.
Untrusted text stays data
Retrieved knowledge entries, message excerpts, and member questions are treated as data, never instructions. Prompt content is sanitized and bounded before it enters model context.
Every action is on the record
Each write records who asked, which tool, the arguments, and the result — the same audit trail for AI and slash paths. Scheduled work is durable and idempotent: a crash replays missed work once, never twice.
Data has a sunset
AI conversations older than 30 days are excluded at read time and pruned daily. Chat logs are encrypted at rest. Backups are encrypted and restore-tested. A private forget action removes a member's conversation history.
Failures are honest
When a provider fails or a budget runs out, surfaces say so in plain text instead of guessing. Digests fall back to raw counts rather than invented prose. Status is observable at /status.