{ / docs / safe actions / ]
How ai.NEST decides what it may do
The AI proposes an action. A person and the system approve it. Only then does it run.
ai.NEST never performs an action on its own.
[ 1 ]
What happens, step by step
- 1.You ask, in plain language. "Give Bob viewer access to billing."
- 2.ai.NEST proposes the action. It shows exactly what it will do and with what details, before anything happens.
- 3.The policy engine checks it. Is this person allowed to run this action, and are the details valid?
- 4.You confirm — it runs. The action executes and you see the result in place, no page reload.
- 5.Not allowed? Nothing happens. ai.NEST explains why — role restriction or a missing detail — and stops.
[ 2 ]
Confirmation, in view
A proposal appears as a card right under the AI's reply — action name, the details it will use, and a status label. When it needs your approval, a Confirm & execute button is shown; once you run it, the card updates in place with the result (or, if it failed, the reason why) — no page reload. A rejected proposal shows why it was rejected instead of a button.
[ 3 ]
A rejection is a feature, not a bug
When the policy check fails, ai.NEST tells you exactly why — a role restriction, or a missing or invalid detail — and stops. Nothing runs silently, and nothing runs "close enough": the wrong action, the wrong person, or an incomplete detail get caught before anything changes in your systems, not after.
[ 4 ]
Who can do what — roles
Access is controlled by role. Higher roles include everything the lower ones can do:
| Role | Can do |
|---|---|
| Viewer | See knowledge, data, and answers. |
| Editor | The above, plus manage knowledge and data. |
| Owner | The above, plus manage the team and run sensitive actions. |
Each action declares the minimum role required to run it. Sensitive actions (like granting access) are restricted to higher roles, and typically require an explicit confirmation before they run.
[ 5 ]
Every action is on the record
Every action ai.NEST proposes is recorded: who asked, what was proposed, whether it passed the policy check, who approved it, the result, and when each step happened. Filter by status, action, and date, and export the full history as CSV or JSON at any time — for your own records or for an audit request.
[ 6 ]
What ai.NEST does not do
- Execute an action without your confirmation.
- Bypass your policy checks — role and detail validation run on every single proposal.
- Run an action above what a person’s role allows.
- Leave an action off the record — every proposal is logged, approved or not.
Want to see this policy engine on your own data? Join the early-access waitlist →