Trust
Nothing changes without your yes. Everything shows its work.
Autonomy your security team can sign. AI that touches enterprise data has to be governable, provable, and reversible — as behavior you can test on day one, not a promise in a deck. These are the guarantees Kaarvi is built to keep, on every action, for every user.
The guarantees
Six promises, built in
A check that catches a mistake gets it fixed, on the record. When the independent check disputes a first answer on something it can prove, Kaarvi re-derives the answer once from the evidence it already gathered. The correction is shown only if it holds up under a second check; otherwise the original stands, with the failure stated. A corrected answer is labeled as corrected, and the receipt keeps the first answer beside the second.
Nothing changes without a yes
Anything that would change your data shows you exactly what will change first — the rows, the violations, the consequences — and waits for approval. The only ways past that preview are ones you authorized yourself: a standing grant you signed, or a low-risk change with a proven one-sentence undo.
Answers are checked before you see them
Every answer is verified against your source data, independently of the work that produced it. And when Kaarvi cannot stand behind a number, it says so with the reason — it refuses rather than bluffs. “Done” is said only after Kaarvi reads back what is actually stored and finds what you asked for. A change it refused is told as refused — never as done.
Every act leaves a receipt
What ran, what it read, what it cost, who approved it, and how to reverse it — on the record, inspectable by your auditors. The record cuts both ways: Kaarvi can neither deny what it did nor claim what it didn’t do. A turn that fails says why on its own receipt — which stage stopped, and what was unavailable — never a blank.
Spend is bounded before it happens
One meter with hard limits by default: when included usage runs out, work pauses and your usage view shows exactly what was spent — nothing bills behind your back. Work you delegate runs under a budget you granted; when it runs down, renewal comes back through you, never a silent charge.
Undo is designed in, not promised
Reversibility is engineered and tested, not asserted: for changes that can be undone, undo is a sentence. Each act in a delegated job has its own reverse: a rename returns the old name, a share is withdrawn, a pause resumes. Never the discard of the whole job. Undo is offered only where it would really run; a refusal that changed nothing has no undo door. And where an act is genuinely irreversible — a deletion, a sent message — Kaarvi tells you so before it acts, never after.
Autonomy is earned, never assumed
Kaarvi starts by watching and proposing. Anything that runs standing is something you set up and can stop — schedules you created, grants you signed, each scoped and revocable. Deeper autonomy grows only on evidence you’ve seen, with you signing every promotion.
The floor beneath the guarantees
Enterprise controls on every path
- Customer isolation enforced on every agent turn — designed so one customer’s data never reaches another’s answers.
- Role-based access on every skill, with column-level masking policies your admins govern — people see what their role permits, including in AI-composed replies.
- Single sign-on with your identity provider, enforced for your domains, and a complete audit log.
- Organization-wide spend limits, set by your admins, honored everywhere.