Automating safely: risk, approval, undo

An assistant that only suggests text can’t do much harm. One that does things (sends emails, publishes posts (soon), writes invoices, changes Google (soon)) needs safeguards that don’t rely on good intentions. This guide explains the seven safeguards in NEVYLO and what they mean day to day. Not because you have to configure them, but because you should know they’re there.

1. Actions are defined, not improvised

NEVYLO can only do what’s in its action registry: “send email”, “publish post (soon)”, “set opening hours”, “create invoice”. Every action with typed inputs and outputs, risk class, required permission, cost estimate and a statement of whether and how it can be undone. The model can’t invent an action. Whatever it proposes is checked against this definition before anything happens.

For you, that means: no model output is executed unchecked. Ever.

2. Risk is a property of the action

Low, medium, high. Set per action, not per mood. Sending an email is always at least medium (irreversible). Deleting is always high. A quote above your threshold is high. That way, a harmless-sounding phrase (“just send a quick note to all customers”) can’t slip past the approval system.

3. Approvals answer seven questions

What, Why, Where, Data, Cost, Undo, Who. An approval card that can’t answer one of these questions isn’t shown, and the action isn’t executed. That sounds strict, but it’s the reason you can trust an approval in ten seconds.

4. Execution with a safety net: idempotency, timeouts, retries

Every step has a unique key. If the connection drops and NEVYLO tries again, the email isn’t sent twice and the invoice isn’t created twice. Steps have timeouts; if a provider hangs, the step is aborted and logged. If a step in a chain fails, the previous ones are compensated where possible. The post (soon) isn’t published if the image couldn’t be uploaded.

5. Verification: success is checked, not claimed

After every action, NEVYLO checks the result: have the opening hours really changed on Google (soon)? Is the post (soon) live? Was the email accepted? Only then does it say “done”. If an integration isn’t connected, it says “connection required”, not “done”. Honest error messages are a security feature.

6. Audit log and undo

Every task, every step, every approval, every automation: who, what, when, where, with which data, with what result. The log is your memory and, in a dispute, your evidence. Whatever is technically reversible (website versions, profile changes, scheduled posts (soon), appointments, drafts) has an undo button. Whatever isn’t reversible was approved beforehand.

7. Kill switch and budget limits

“Stop everything” halts every running task and every automation immediately, in the mobile app (soon) too. Budgets cap what NEVYLO may spend per month on AI, media and phone costs (soon); paid steps show the estimate beforehand. And concurrent tasks per business are limited, so one mistake can’t happen a hundred times over.

What this means for you

You don’t have to configure any of this to be safe. The default setting is tight. You loosen rules when the audit log shows you’ve granted the same approval a hundred times without changing anything. Autonomy grows with trust, verifiably. And if something does go wrong at some point, within a minute you know what happened, why, and how to roll it back.

One last note: NEVYLO safeguards the execution, not the legal position. Whether a payment reminder is worded correctly in legal terms or an invoice is correct for tax purposes, NEVYLO checks against your specifications, but it does not replace legal or tax advice.