Every tool call, checked first.
Every tool call is checked before it runs — allowed, held for your approval, or blocked, as your policy says — and written to a log you can read.
Sarah asked about the Henderson place — can you get back to her?
- Read your thread with Sarah Chen. She asked about Henderson Ave on Sunday and you never replied.
- Checked the listing. Still active, and the price dropped $15k on Friday.
- Pulled three comps within half a mile that closed this month.
- Looked at your calendar. Thursday 2pm and Saturday 11am are open.
- Wrote her a reply with the comps and both times.
“Hi Sarah — Henderson just came down $15k. I pulled three comps nearby, all closed under ask. I have Thursday 2pm or Saturday 11am free if you want to walk it.”
“Hi Sarah — Henderson just came down $15k. I pulled three comps nearby, all closed under ask. I have Thursday 2pm or Saturday 11am free if you want to walk it.”
Sent to Sarah on your OK. Booked provisionally for Thursday 2pm, held on your calendar until she confirms.
A policy layer
Every tool call is checked against your rules before it runs. Sending mail, touching a calendar: your policy decides which need a human, which go ahead, and which are blocked outright.
Approve in the thread
Anything held for approval arrives as a message. Reply to approve, reply to change it, or say nothing and it never happens.
On the record
Every tool call is logged with what ran, when, and the policy decision. Open any one to read why it was allowed, held or blocked.
A day, on the record.
This is what your log looks like. Held actions asked you first. Blocked ones never ran. Open a row to read the reasoning.
Reading your own message threads is always allowed under your default policy. No approval needed, and it is still written to the log.
Read-only lookup against the MLS connection you authorised at setup. Nothing was written or shared.
A rule you set holds messages to this client for approval. The draft sat in the thread until you replied “send”.
Released by you at 07:44 with a one-word reply. The exact text that was sent is stored against this entry.
Calendar holds on your own diary are pre-approved. Invitations to other people are not — that is a separate rule.
A rule you set denies payment links above $2,000 outright, so it was blocked, not held. There is no approval flow for it — at this amount it cannot run.
Writes to your own CRM are allowed within the bundle scope. Each field change is recorded individually.
Messages to you aren't held. This one went straight to your thread.
Open any row to see why the agent did it.
Your agent runs in its own container. Your data isn't used to train anything. Every tool call it makes goes in your audit log, and you can revoke the whole thing in one message.
Where we are on certifications.
Honest about timelines. We're a small team working toward certifications methodically, and this is the roadmap.
Email security@wrasse.ai for current status, our security review materials, or where our data processing agreement stands.
Found something? Tell us.
Send security issues to security@wrasse.ai. Please include reproduction steps, impact, and any proof-of-concept code. We acknowledge within 24 hours, triage within 72 hours, and credit researchers in our public disclosure log unless you'd rather stay anonymous. The bug bounty opens publicly in January 2027; private payouts now.
Please do not test against accounts that aren't yours, exfiltrate any data, or run automated scanning that affects service availability for other users. Everything else is on the table.