People decide

The AI can only use the same registered operations people use. There is no AI-only back door. The AI writes within the permissions of the person who asked, and reads only within the company's scope. What that person may not do, the AI may not do either.

Every operation declares what it does: read, write internally, send outward, publish, move money, delete, issue credentials, decide, and so on. On the AI's path, each is handled accordingly.

• Reading and internal writes happen under the permissions of the person who asked.
• Sending outward, publishing, moving money and deleting require a person's approval or a mandate a person granted.
• The AI cannot issue credentials or permissions, and cannot make decisions such as adopt or reject on its own.

Approving the same kind of task every time is tiring, so a person can give the AI a mandate. The mandate states which operations are delegated and the budget. Exceed either one, and the work stops and is recorded as awaiting approval.

Only a person can grant a mandate. The AI cannot issue one to itself.

Once something is approved, it is not the AI that carries it out. It is code that follows a fixed, predetermined procedure. An approval is bound to the exact input that was approved, so what you approved and what actually happens do not drift apart. Who asked, what ran and who approved it are recorded under an add-only policy.

What the AI finds in your material normally does not become company knowledge until a person adopts it. There are two exceptions, and both are recorded:

• The procedure that imports a whole blog has a step that adopts the extracted candidates in bulk.
• When old articles are rebuilt as knowledge, a candidate whose evidence is found in the material, whose confidence meets the threshold and that conflicts with nothing is adopted by the machine, with the reason recorded.

Merging similar knowledge and deciding on proposals and candidates are done by people only.