How Achilles Keeps Agents Safe
An AI agent that talks to customers and touches policy or account data must be safe by design, not by good behaviour. Achilles is built on one idea: the important rules are enforced by the platform itself, outside the AI model, so no clever question and no prompt can talk an agent past them. This page gives risk and compliance teams the overall picture. The pages that follow go deeper on each control.
Rules the AI cannot bend
It is common to protect an AI system by writing instructions such as "never show another customer's data". That is a request, and a model can misread or be talked out of a request. Achilles does not rely on it. Access checks run in the platform's own code, between the AI and your systems. The AI can ask for something, but the platform decides whether it happens.
Every ability an agent uses goes through the same checkpoint. There is no side door.
The five controls
| Control | What it does for you |
|---|---|
| Role-based access | Each person who talks to an agent has a role. The role decides which abilities the agent may use for them, and which records they can see. A branch employee sees their branch, a broker sees their own customers. See Roles and access. |
| Approvals | Before an agent changes anything, such as creating a lead or updating a status, the person must confirm the exact details. See Approvals. |
| Personal data protection | Sensitive fields are hidden from people who should not see them, and are never written to the audit record in readable form. See Personal data. |
| Human handoff | When a customer is stuck, upset, or the case is high stakes, the agent stops and passes the conversation to a person. See Human handoff. |
| Audit trail | Every conversation step and every administrator action is recorded. See Audit trail. |
No invented numbers
Premiums, balances, dates and claim amounts are never worked out by the AI. The agent calls an ability that reads or calculates the figure from your own system, then presents it. This removes a whole class of errors where a language model produces a plausible but wrong number. If the figure is not available, the agent says so rather than guessing.
Safe when something is missing
The platform is built to refuse when in doubt. If a role is unknown, an ability is not permitted, or a data restriction is missing, the request is denied rather than allowed by default. A misconfigured agent fails closed, and the denial is recorded so you can see it.
What the AI can and cannot do
| The AI agent can | The AI agent cannot |
|---|---|
| Use only the abilities you have given it | Use an ability outside its configuration |
| Read records the signed-in person is allowed to see | Read another customer's or another branch's records |
| Propose a change and explain it in plain words | Carry out a change without the person's confirmation |
| Present figures returned by your systems | Calculate or estimate figures on its own |
| Work within the step limit you set for one request | Run indefinitely or loop on a task |
| Hand a conversation to a colleague | Decide to hide an escalation or skip the record of one |
| Answer from your approved procedures | Change its own permissions or rules |
Achilles controls what the agent can access and do. It cannot guarantee that every sentence a language model writes is perfectly worded. That is why we recommend testing before launch with Test your agent and reviewing real conversations regularly with the routine in Monitor your agent.
Checking it works
Before you go live, you can try your narrowest role in the Playground and ask for something that role should not receive. The agent should decline, and the refusal will appear in the conversation record. The Guardrails page under Govern in the console shows, in read-only form, the rules that apply to the selected agent.
Questions reviewers often ask
Who can change the rules? Only workspace members with access to the agent's configuration, and every save, deploy and restore is recorded with who did it and when.
Can a customer trick the agent? Customers can try. Because access is decided by the platform, a persuasive message cannot widen what the agent is allowed to see or do.
Where do I start? Read Approvals and Personal data next, then have your risk team walk through Audit trail.