It proposes. A person decides. The decision is logged.

• Its sources — the specific records it read, linked so you can check the reasoning.
• A confidence value, and the threshold below which it is not surfaced as a suggestion.
• The effect it would have if accepted, described in the same terms as a manual action.
• An estimated cost where the operation consumes model capacity.
• The approval step, naming the role permitted to accept it.

• Propose a cause for a reconciliation exception, with evidence.
• Propose duplicate merges, with the differing fields shown.
• Draft donor outreach for a failed recurring payment, for a human to review and send.
• Summarise a donor relationship from records the requesting user already has permission to read.

• Post, match or reverse a financial record.
• Create, alter or reissue a receipt.
• Send any donor-facing message unattended.
• Bypass permissions, tenant scope, consent state or feature gating.
• Read across tenants, or use one organization's data to answer another's question.

Tenant and donor data is not used to train models by default. Donor personal data is not placed into model context for convenience — where a task can be done with identifiers and amounts, that is what the model receives.

AI activity is recorded in an immutable log: what was proposed, on what evidence, who accepted or rejected it, and when.

The agent surfaces, evidence display, confidence scoring, approval thresholds, preview and undo all exist in the product as prototypes on illustrative data. The governance rules above are how they are built, and they apply from the first real deployment rather than being added later.