Security, compliance & guardrails
What stops it doing something you would not.
These are the capabilities that decide whether an autonomous agent is safe to point at your customers: what it tells them, what it is allowed to spend, what it refuses to do without a person, and what happens when someone tries to forge their way in.
Text 214 contacts an offer for a spring check-up, 15% off, valid to the end of the month.
- Recipients
- 214 (3 skipped — do-not-contact)
- Channel
- SMS · +1 206 ··· ····
- Estimated cost
- $2.82
Reply YES 4821 to go ahead
expires in 24h · one use · recipient list frozen
Or just ask for it
The stop is where you already are.
Money and mass messages come back for a code, in the same thread.
InboxConfirm: message 1,204 contacts — YES 6208
Text every customer about the new Saturday hours.
1,204 recipients, est. $61.40. 31 excluded for SMS do-not-contact. Reply YES 6208 — one use, expires in 24 hours, and the list is frozen now, so it can’t quietly grow while you decide.
@Octo cap voice at 200 minutes a day, we got surprised last month
On it 🔧(runningvoice_set_minute_budget…)
Capped at 200/day. Calls stop at the ceiling rather than reporting it afterwards. (edited)
✅ 3💸 12 replies · last reply 11m ago
and warn us at 80% not 100%
Email octo@agent.omniocto.com · WhatsApp 1-MAN-ASK-OCTO · Slack #omniocto
- AI disclosure on every call
- On by default, with wording you can edit or a recording of a real voice that plays verbatim. Each call keeps an audit row of what the person was told.
- Recording-consent handling
- Consent to recording is part of the disclosure rather than a separate thing to remember.
- Two-layer DNC enforcement
- Do-not-contact is enforced at more than one point with a full audit history, so an opt-out cannot be defeated by a stale list.
- 10DLC and toll-free verification gates
- US business messaging verification is treated as a gate before volume sending rather than a warning, which is what keeps messages being delivered.
- Launch-time compliance acknowledgment
- Creating a campaign that contacts anyone requires confirming you have the right to contact them — deliberately in the way rather than buried in settings.
- One-click unsubscribe
- Standards-compliant unsubscribe where the standard applies, so opting out is one action rather than a reply and a hope.
- Toll-fraud geo guard
- Calls to destinations you never intended to dial are blocked, which is the attack that turns a compromised key into a five-figure bill.
- Five-level tool risk classification
- Every tool is classified safe, spends money, mass message, destructive, or changes a live deployment — and the classification is enforced in the build, so a new tool cannot arrive unclassified.
- YES-code confirmations
- Money, mass messages and destructive actions stop with a plain description and a short code. It is good for one use, expires after a day, and the recipient list is frozen when the question is asked.
- Role-based permissions
- What a person can do is bounded by their role rather than by everyone sharing one login.
- Monthly LLM budget with mid-run abort
- A monthly ceiling on model spend that stops work when it is reached, rather than reporting it after the money is gone.
- Daily voice-minute caps
- A daily ceiling on talk minutes per workspace, which is what bounds a large campaign before it starts.
- Spend alerts at 50/80/100%
- Warnings on the way to the ceiling, sent to you and respecting quiet hours.
- Email spoofing protection
- SPF, DKIM and DMARC are evaluated before an inbound message reaches a tool, and only the verdict from trusted mail infrastructure counts — a forged verdict inside the message is stripped. If it does not pass, there is no tool access.
- Prompt-injection quarantine for forwarded mail
- A forwarded body is fenced as untrusted content, so instructions planted inside it are read as data. Your own covering note stays trusted, and an unclear split fences the whole thing.
- Four-layer loop prevention
- Auto-responders, bounce notices and repeated content are caught by four independent layers. The failure being designed out is a mail loop between two automated systems overnight.
- Data-retention sweeps
- Old data is swept on a retention schedule rather than kept forever by default.
- Per-workspace telephony isolation
- Each workspace has its own telephony subaccount, so one workspace’s numbers, spend and reputation are separate from another’s.
What this powers