CapyAgent an agent that walks into your business systems itself. Go core, Python connectors, your data stays with you.
Manifesto · open text
A chat answers questions. An agent works: it reads the customer base, edits deals, writes mail on the company's behalf and reports the numbers decisions are made on. It should be held to the standard of a staff member with access, not of a conversation partner. Below are the eight rules we build CapyAgent by, and the mechanism behind each one.
This text is open. Take all of it or parts of it for your own product, no credit required.
Why this exists
A language model on its own is harmless: it talks. An agent is that same model handed the keys to the CRM, the mailbox, the phone system and the ad account. At that moment the conversation ends and work inside the company begins.
The market sells agents as a chat with a monthly fee, so the discussion is about price and the number of integrations. We think that is the wrong question. Next to «what will it do without asking», «where does the data go» and «how will I know the number is incomplete», price comes second. Answers to those are not written in a product description: they are either built into the thing or they are absent.
We are putting our rules in writing so that they can be held against us. Each one is backed by a mechanism: code, a test, or a log on your side. A rule without a mechanism is not a promise but an advertisement, and we do not write those.
Principles
The order is deliberate: what cannot be repaired after the fact comes first.
01 consent
Sending mail, editing a deal, spending money, publishing: the agent shows the whole thing before it happens and waits for a yes. Consent is single use, permission for this letter does not carry to the next one. It reads on its own, it changes things only together with a person.
02 data
The agent runs on your machine or in its own cell on a server. The only outbound requests go to the services you connected yourself. There is no telemetry in the code - not a promise not to collect, but the absence of anything to collect with.
03 reporting
The answer names the system, the period and the counting method. A number without an origin is an opinion, and you cannot decide on it. The same leads counted three ways give three different results, and the client should see that gap, not only the person who counted.
04 reconciliation
If a service claims five hundred records and hands over four hundred and eighty, the agent says so before the number reaches a report. A silent shortfall is worse than an error: errors get noticed, missing rows do not.
05 honesty
When the systems hold no answer, the agent says exactly that instead of supplying a plausible number. Plausible is worse than empty: an empty spot gets questioned, a plausible one travels into a deck as fact.
06 mechanism
A capability is real if breaking it breaks a test. A line in the docs, a comment in the code and a slide in a deck are not capabilities. We have caught the opposite in our own work and treat it as a defect, not a detail.
07 log
Every action stays in a log on your side: which request, to which system, what came back. The agent's work can be audited without us - including after you leave us.
08 boundary
The agent prepares a decision, it does not make one. The person answers for the letter that went out, the document that was signed and the number in the report. Selling anything else means selling a release from responsibility that does not exist.
Verification
The right column matters more than the left: a rule you cannot check yourself stays our word for it.
| Rule | Mechanism | How to check it yourself |
|---|---|---|
| 01 Nothing irreversible in silence | Dangerous actions are a separate list in the core and always route to confirmation | Ask it to send an email: it shows the text and stops |
| 02 The data stays with its owner | Runs on your machine, outbound requests only to connected services | Search the sources and watch the network log on the agent's machine |
| 03 A number arrives with its source | The connector attaches source, period and method, not the model | Ask «where is this number from» after any answer |
| 04 Incompleteness is said out loud | The connector compares the record count a service claims with what it delivered | Compare the agent's answer with an export for the same period |
| 05 «Not enough data» is a valid answer | The answer is assembled from what the systems returned, not completed by the model | Ask for something the connected systems do not hold |
| 06 A capability exists where a test exists | 910 tests, each about a specific way to lose data | Run the test suite yourself after installing |
| 07 What it did is visible | The request and response log is written on your side | Open yesterday's log |
| 08 A person carries the responsibility | Automatic execution of dangerous actions is off, consent is single use | Try granting blanket permission in advance: there is no such mode |
Limits
Without this part a manifesto turns into marketing. Here is what the agent does not do, and we are not going to pretend otherwise.
Next
Take the question your team currently answers by hand and put it to the agent. The answer comes back with a source, a period and an honest caveat wherever the data ran out.