AI proposes. A human decides.
Every product on this site that uses AI is built the same way: the model can draft, narrow, or narrate, but it never gets to act on its own. Wherever a step could change something real, a human approves it first, or the step is fixed by a deterministic rule instead of left to the model's judgement. Here's exactly what that looks like, not a values statement asking you to take it on faith.
What this looks like in practice
Three real examples, each checkable against the actual product or code, not a general principle asserted without evidence:
- Directory Hygiene proposes a fix for an access or ownership problem it finds, but nothing writes back to a directory without a human sign-off. The proposal and the write are two separate, distinct steps, never one. See Directory Hygiene.
- The IAM Platform Health Check's AI-written summary doesn't decide anything: your score is fixed by deterministic rules before the model is ever called, and the model's job is only to narrate a result it can't change. It's told explicitly not to invent facts, its output is checked server-side against a known, exact set of categories before use, and it renders as plain text, never as markup it generated itself. See IAM Platform Health Check.
- Our own build process uses an AI coding agent to help build products like Directory Hygiene, but every change it produces goes through an independent review pass, a second pass that audits that review itself, and our own sign-off, before anything ships. Speed doesn't buy a shortcut around checking. See Agentic AI-Driven Delivery.
The shape of a guardrail
The exact form varies by feature, but the underlying pattern is consistent: decide as much as possible by fixed rule rather than by the model's judgement, keep whatever the model does contribute narrow and checked, and put a human between any proposal and any action that changes something real.
Why we build it this way
It isn't caution for its own sake. Identity and access work has real consequences: who can reach what, what an auditor can rely on, what a certification actually means. A wrong autonomous call in that context isn't a minor bug to patch later, it's the kind of mistake that shows up in an access review or an audit finding months afterward. Keeping a human as the final decision-maker on anything that acts, rather than just on anything that's visible, is the difference between AI that speeds up judgement and AI that quietly replaces it.
We'll be just as plain here as anywhere else on this site: this describes what we've actually built and can point to, not a framework we aspire to. As we build more with AI, we'll hold new work to the same bar, and say so if something falls short of it.
Want the deep dive on how we build software with AI agents?
This page is about how the AI in what we ship behaves. A separate page covers the review discipline behind how we actually build it.