Bounded requests.
Accountable actions.

Every record change is a proposal

The case agent reads fictional records and proposes tasks, notes or case updates. The officer approves each proposal before the existing CRM store validates and applies it locally. CASE-1042’s evidence and handover workflow retains its separate exact-version review. There is no connection to agency records, email delivery or live bookings.

A constrained API

The server fixes the instruction, model configuration and tool definitions. It accepts bounded JSON conversations, checks tool names and input schemas, and requires a matching result for every tool call. Unknown fields and duplicate tool identifiers are rejected. Cross-origin browser requests and requests without explicit live permission are rejected.

Request and response bodies are limited while being read. Each model request has a deadline; the browser’s Stop control aborts its request and the server forwards cancellation where the runtime supports it. Cancellation cannot guarantee reversal of model work or provider charges already incurred. There are no automatic retries of a paid model step.

Availability and cost boundaries

The edge rate limit covers model-interface POST requests across function instances within each Vercel region. Local concurrency and a short provider circuit breaker remain additional bounds. The shared PostgreSQL ledger uses row locks and integer AUD cents so each authenticated user’s charged and reserved amounts cannot exceed AUD 20 in a Melbourne calendar month. The database fixes that limit; a browser cannot enlarge it or supply its billing identity. A request ID cannot dispatch twice, and a possibly billed timeout keeps its hold.

Paid model calls are disabled by a source-level release lock. Environment flags, sign-in and privacy consent cannot unlock them. Enabling paid processing requires the owner’s explicit authorisation and a reviewed cost envelope and provider limit. If identity verification or the shared ledger fails, model requests fail closed; there is no in-memory monetary fallback.

The health endpoint reports this instance’s availability and replay/live mode. It makes no model call and is not a certification of every dependency.

Browser isolation

A Content Security Policy restricts scripts to this site and its exact inline import-map hash. Inline event handlers, embedded frames and plugins are blocked. Response headers prevent framing, disable MIME guessing, restrict device permissions and isolate opener relationships. Style attributes remain allowed for the retained visual engines.

Minimal application logging

Agent request logs contain a generated request ID, response status and duration. The application does not log tasks, tool results, API credentials or IP addresses. Short-lived rate-limit keys use a per-process keyed hash and disappear when the instance ends. Hosting providers may separately retain technical request logs.

Controls you can use now

Saved demo edits and live processing start off. You can choose a saved-edit expiry, grant live permission for one hour, export saved tab data or clear it. The site displays a supported browser’s Global Privacy Control signal. Application code includes no advertising pixels or analytics trackers; these settings do not control independent hosting infrastructure.

Scope and responsible reporting

The optional account backend is limited to invited identity, short sessions and allowance records. Server-only database functions are inaccessible to anonymous and signed-in browser roles. This prototype has no production client-record storage or agency-system integration. No security certification, penetration-test result, end-to-end encryption or guaranteed data residency is claimed. A customer pilot still requires its own record access controls, retention, recovery and security review.

Report a suspected issue to founder@rsiagent.app. Send a concise description and non-sensitive reproduction steps; do not include credentials or real client data. There is no published bug-bounty programme or response-time guarantee.