Safety

Built to be left alone.

It runs unattended, so every limit is a mechanism rather than an instruction: a gate it cannot pass, a budget it cannot raise, a capability it was never granted.

Emergency stop

Stops every agent on the product. An admin may stop it; releasing it needs an owner, and their password again.

The six gates

Six decisions an agent can reach but never make.

Each is held by something the agent cannot argue with — a missing permission, a stopped run, a draft that has nowhere to go — and lands in one inbox with what it holds.

Merge01
Holds a change reaching trunk
Agents have no right to push to the default branch. A change reaches it only through an approved gate.
Deploy02
Holds a release reaching production
A release reaches production only after a person approves it — the release agent requests, it never grants.
Spend03
Holds a role or product that has hit its cap
The cost governor stops a role that reaches its daily cap, wherever it is, and opens a gate.
Customer-facing04
Holds anything an agent wrote being sent or published
Support and Growth write drafts. Nothing an agent wrote is sent or published until a person approves it.
Legal05
Holds a change to terms, privacy, pricing or licensing
Terms, privacy, pricing and licensing changes route to a gate no agent may close.
Scope06
Holds a project's analysis becoming the work agents do
A project's analysis becomes items only after a person approves its scope. Until then, agents have nothing to build.

Undo

Undoing damage never waits for a signature.

The writes that only reduce blast radius are open to the roles that watch production, at any hour.

Roll back
Put the last good release back.
Through Vercel, Expo EAS.
Halt a rollout
Stop a phased or staged release where it stands.
Through Expo EAS, App Store Connect, Google Play.
Turn a flag off
Switch off the feature that is hurting.
Through Vercel.

By design

What no agent may do, whatever it is told.

Grants, not instructions: Each role holds only the capabilities its role file grants. Anything else is refused by the runner, not discouraged by a prompt.
Outside text is data: A role that reads tickets, reviews, logs or the web may never merge, deploy, promote or send a reply on the strength of it.
A ceiling, not a meter: Every role has a daily cap and every workspace a monthly allowance. Reaching one pauses agents; nothing is spent past it.
Every run on the record: Inputs, tool calls, outputs and cost, for every run — the trail behind every change, kept with the person who approved it.
Secrets stay out of the transcript: Saved credentials are encrypted, and secret patterns are redacted from everything stored and streamed.
Each organization apart: Data, credentials and runs belong to one workspace, and the database refuses a read that crosses into another.

Found something that looks unsafe, or need our security answers for a review? Send us a message, or write to us at admin@omnirecursivelabs.com.

Start in paper mode. Go live when you mean it.

Every integration is mocked until you add credentials, so you can watch the whole organization work on your product before it touches a real system.

Or write to us directly: admin@omnirecursivelabs.com