The assistant cannot seemore than the person.

No second tablefor permissions.

You do not manage what the assistant can reach from a separate screen. The moment you change a staff member's role, their assistant changes too — because the source is the same.

While the tool list is built

gate 1

When the tool is called

gate 2

When approval is given

gate 3

An unauthorised tool and a tool that does not exist return the same answer. Giving different messages would leak which tools exist to the assistant.

Nothing changeswithout approval.

When the assistant calls a write tool, the tool does not run. A box appears in the panel describing what will happen; until you approve it, nothing in the database changes.

• A pending action belongs to one person and one conversation; you cannot approve someone else's
• Permissions are checked again at the moment of approval
• Every call and every approval is written to the audit log
• A rejected action stays on record rather than quietly disappearing

It remembers,without leaking.

Working knowledge you explain once is remembered in later conversations. But every note is stored together with the permission it requires.

• A personal note is visible only to the person who wrote it
• A note shared with the team is tagged with that domain's edit permission — it never flows downward
• Only a human can share a note; the assistant cannot do it on its own
• What the assistant knows is listed in the panel, and you can delete any of it

Volatile values — prices, stock, revenue — are deliberately not remembered. The assistant learns how to reach the stock figure, not the figure itself.