Safety model

Permission is earned, constrained, and reversible where possible.

SkyTwin treats automation as a series of checks with a human fallback—not as an instruction following contest. The current developer preview makes those constraints inspectable, but it does not claim release-wide evidence beyond the claim ledger.

Invariant: no candidate action may auto-execute without policy evaluation. If a system cannot explain an action or safety input is missing, it must stop or escalate.

What the system is defending against

Overreach

A mistaken guess becomes a real action

Trust tiers, policies, risk assessment, approval routing, and explanations turn a prediction into a reviewable decision.

Financial harm

A small error turns into spending

Per-action, daily, and domain spend limits are mechanical hard caps. No rounding or “close enough” exception exists.

Privacy and social harm

External content manipulates behavior

Provenance and the injection guard distinguish user-authored material from inbound content, web pages, files, and other untrusted origin.

Operational failure

Retries or outages hide an uncertain result

Typed outcomes, circuit breakers, and reconciliation stop a failed or ambiguous path from being silently treated as success.

The defense stack

Layer	What it decides	Fail-safe behavior
Sample boundary	What the fictional account-free sample is allowed to read or simulate.	It uses a synthetic fixed identity and a read-only route allowlist; product settings, credentials, execution, and writes remain outside it.
Trust tier	Whether a user has earned any autonomy in a domain.	New users begin at observer; no autonomy is assumed.
Policy and domain controls	Explicit user rules and enabled domains.	A denied domain stays denied; a policy has veto power.
Spend, risk, reversibility	Financial impact and likelihood/cost of undoing work.	Over limits, high risk, or irreversible shapes escalate rather than approximate.
Provenance and injection guard	Whether source content can influence destructive work.	Missing action provenance is untrusted external. Destructive-shaped untrusted work needs human confirmation.
Approval and execution routing	Whether a supported candidate waits, routes, or ends as non-action.	An escalation is a terminal non-executing path; no generic fallback executes it.
Explanation and feedback	Whether a user can inspect and correct a supported outcome.	If explanation persistence required by the path fails, the action cannot advance through the approval path.

Trust tiers: the default is observation

Tier	Autonomy	Promotion shape
`observer`	All actions require explicit approval.	Initial state. Current implementation treats observer/suggest similarly; the distinction is documented as due for reconsideration.
`suggest`	All actions still require approval.	10 consecutive approvals, at least 80% cumulative approval ratio, and 24 hours in tier.
`low_autonomy`	Low-risk reversible work in allowed domains may auto-execute.	20 consecutive approvals, at least 85% ratio, and 72 hours in tier.
`moderate_autonomy`	Moderate-risk allowed work may proceed; high-risk/irreversible work remains reviewed.	50 consecutive approvals, at least 90% ratio, and seven days in tier.
`high_autonomy`	Most allowed work except critical-risk shapes; irreversible work requires explicit domain policy.	Explicit user opt-in only—there is no automatic promotion to this tier.

Important implementation qualification: the engine has a time-in-tier threshold, but some production callers do not yet populate the required timing statistic. The source safety model documents this as an open enforcement caveat; do not assume the time floor is release-wide evidence today.

Untrusted content cannot grant itself authority

Inbound email, calendar invitations, web pages, filesystem content, and third-party text are documentary-poisoning surfaces. Every action has action provenance; absent provenance fails to untrusted_external. The candidate generator cannot choose a more trusted value for itself. Destructive-shaped actions from untrusted origin require human confirmation—two confirmations for extreme shapes such as shell, filesystem, database, or account destruction.

For an external agent, a proposal is also not authorization. The current MCP propose_action tool records a non-executing decision and candidate for inspection, but it does not yet run policy evaluation or create an actionable approval request. See the agent guide.

Pause, audit, deletion, and recovery

Global pause: SKYTWIN_AUTO_EXECUTE_DISABLED=true routes otherwise allowed work to approval. A denied action remains denied; pause is not a bypass.
Per-user pause: a user can pause autonomy and resume later. It complements, rather than replaces, a trust-tier demotion.
Explanation/audit: supported decisions record what happened, evidence, preferences, selected outcome, and correction guidance. Credential-vault decryptions write append-only access-log records.
Right to erasure: the supported deletion flow uses a two-stage confirmation and an owner-scoped serializable transaction to remove a user footprint, or roll back as a whole.
Rollback: reversible actions may be undone through the normal feedback path. Irreversible external consequences cannot be falsely marked reversible.

Read the complete safety model for threat-specific failures, escalation formatting, logging, and rollback details.