← Back to portfolio
Case study

An assistant that acts, and the brakes that make that safe

An assistant that acts, with brakes.

21klines of TypeScript
83tools
100permission policies
42security tests

Why acting changes everything

Being wrong privately is different from sending it.

The question is what runs while I sleep.

How a request travels

Rona request flow Messages arrive from WhatsApp, email and Telegram. Text from third parties is first summarised by a model with no tools. The agent core, holding 83 tools, then acts; every outbound action passes a permission engine of 100 policies which either runs it or puts it in an approval queue for the owner. WhatsApp Email Telegram Quarantine model with no tools summarises only untrusted text Agent core 83 tools memory, calendar, tasks summary Permission engine 100 policies kill switch per track Runs unattended reads, drafts, reminders Waits for me anything leaving the house
Third-party text never reaches the tools.

Three decisions worth defending

1. Rona writes, Rona never sends

The boundary is the front door, not capability.

Worse on paper, better in practice.

2. Text from strangers is data, never instructions

Prompt injection is the obvious attack here.

The quarantine

A tool-less model summarises; the core reads the summary.

3. Policies, not prompt wording

A rule outside the model beats a wish inside it.

Each track has its own kill switch.

What she actually does

Track Work
Secretary Calendar, tasks, memory, expenses.
Channels Three channels, different tone per person.
Career Daily job scan against hard criteria.
Freelance Finds work, writes in their language, reports in mine.

Where it stands

What I would do differently

The policy set encodes history, not a model.