Safety lives in the platform, not in the prompt.

The mechanics

The rule

• "The model proposes; the platform authorizes." The AI model can only choose an action and fill in its inputs. Every action is a typed tool, registered on one governed gateway.
• The checks that matter, who you are, what the request may do, and whether it needs your approval, live in that gateway. None of them depends on what the model was told.
• The Composer's gestures travel the same gateway, with the same tools, so a person on the canvas and the copilot in the chat are governed by one set of rules.

Plan, then apply

• Planning checks rights, validates the input, dry-runs the tool and builds a diff of what would change. The gateway's own description of it: "Mutates NOTHING".
• Applying happens only after approval, and only against the grant that approval created.

Risk classes

Every tool declares one of five classes. The class decides whether a card is required and how long an undo stays open.

Registration

• The gateway refuses to register a dangerous-write, admin or external tool that declares no approval.
• It refuses a gated tool that cannot fingerprint its target, because a grant would then have nothing to bind to.
• It refuses a card that promises an undo the tool does not have, and a tool that cannot describe its own consequence.
• So a risky tool cannot reach the copilot at all without its gate. The rule is checked when a tool is registered, before any model ever asks for it.

The only yes

• The copilot's own default answer to every card is "deny".
• Approval arrives through one door only, the approve route, and it is checked against the same signed-in person who saw the card.
• Two enforced checks in our build fail if an automatic approval ever appears on a live path.
• Saying no changes nothing, and the copilot says so: "Okay, I didn't" and the act it was asked to do. A card left waiting, or a closed tab, also counts as no.

What pauses

• Publish and unpublish, every delete, schema and settings changes, the bot and AI-crawler policy, user and team changes, the consent policy, capture switches, exports, erasure, store and order acts, and more.
• About 190 of the more than 370 tools a site's team can use, as of October 2026.

Where the chat and the screen differ

• In the chat, five more acts wait for your approval: attaching media, discarding changes, setting who can read a page, and adding or removing a package's content. On their own screens, your own click is the decision.
• On EmDash's own screens, your click is the decision, as EmDash designed it. The gate governs what the copilot does there for you.

Schedules and experiments

• You approve a scheduled publish once, for its exact time. Edit the page in the Composer before then, and the schedule is cancelled.
• A variation of an experiment reaches visitors only through the experiment's own approval-gated activation. An edit to a live experiment's version waits for your approval too.

Undo

• A change that can be reversed returns a single-use undo grant, open for the window of its class.
• Redeeming it runs the same governed steps as the change. If something newer has changed the same thing since, the old undo refuses rather than overwrite it.
• Three doors share one implementation: the "Undo" button and "undo that"; an undo that visitors would see, which first shows its own card, "Undo this change?"; and our operators' own.
• Undoing a page's first publish takes the page offline. Undoing a later publish puts the earlier version back.
• Before you approve, the card tells you whether the change can be undone.
• One-click undo on every change. Coming soon.

The model

• Adapters for Anthropic and OpenAI. Every call outside our tests goes through the authenticated Cloudflare AI Gateway, with payload logging switched off, so only metadata is logged.
• Which model runs is set by our team. Customers choose a tier where their plan includes the choice.
• Copilot calls are written to a cost ledger, and the account's monthly AI allowance is checked on every call.
• With your own keys switched on, every call uses your Anthropic or OpenAI key, or is refused. It is never quietly sent on ours.
• Page copy is one structured call, validated against the sections' own fields, with up to two attempts at repair. If it still fails, nothing is invented: a section with no facts behind it is left out and named, or kept with a note asking for your facts, which blocks publishing until you fill or remove it. Any sample words left are named before you publish.

The record

• Every phase is recorded: denied, dry run, pending approval, executed, rejected, rolled back, error. Each entry carries who acted, on which site and environment, and a plain-language line.
• "Activity" shows these entries to your team, with an undo on each row whose window is open, and export to CSV or JSON.