Growth OS
Agents defined by their permissions, not by their prompt
A prompt is a request. An agent that can be talked out of its instructions was never constrained by them. In Xyranik every limit an agent has is enforced by the runtime: what it may read, what it may propose, how much risk it may ask for, and how sensitive the data it handles may be.
14-day evaluation · no card · start before you connect anything
Operator
Pause a campaign, change a daily budget, move budget between twoRetention
Draft one win-back email, held for approvalResponder
Draft a reply to one email somebody sent youEvery agent
Carries its own ceiling on risk and on how sensitive the data it touches may be. A proposal of any other kind is refused by name.
How it works
Where this sits in the loop
Execute. It does the work. It follows Approve and hands on to Measure.
- 1
Each agent has a declared lane
One reads performance and recommends. One turns a conclusion into a specific change to advertising. One shapes follow-up automations. One writes to customers who have gone quiet. One drafts what the business says in public. One answers the email people send in. What each may touch is a list the runtime enforces, not a paragraph it is asked to respect.
- 2
The workspace is never something the model chooses
Every tool takes the workspace from the run’s context, never from an argument. This is the single most important rule in the tool layer: if the workspace were a parameter, text an agent had read could redirect it at somebody else’s data.
- 3
Writing is reserved in advance
Each agent keeps a number of its tool calls for writing — recording a decision, putting a change in front of you. Without that, a run that read everything it was offered would finish with prose and nothing recorded.
- 4
Authority is lowered automatically, never raised
After enough scored decisions, an agent whose predictions have been wrong has its own authority reduced without anybody intervening. Nothing in the system raises an agent’s authority automatically — that is always a deliberate act by a person.
What you get
You can read exactly what each one may do
The list shown to you is the same list the runtime checks against. There is no gap between the description and the enforcement, because they are the same data.
Every run leaves evidence
A run records what it looked at, what it concluded and what it proposed, with the credits it used. You see the reasoning as a summary and the evidence in full — never the model’s private working.
A proposal waits with its exact wording
Nothing an agent produces reaches a customer by itself. A drafted email waits with the words it would send; a proposed budget change waits with the figure and the campaign. Approving it is the consent.
What it does not do
Listed here rather than discovered later.
Agents propose; they do not act unattended at high risk
Anything that reaches a person, spends money or cannot be undone is declared high risk, and no agent’s own ceiling permits carrying that out alone. The route from an agent’s idea to a real change runs through a person.
You cannot build an agent of your own
The roster is the roster. What you can change is what each one is allowed to do, and the rules it must obey — not its brief or its lane.
Give it a goal and watch what it proposes
Nothing reaches a customer or spends money without you. The evaluation starts before you connect anything, so you can read what it would do before deciding whether it may.