An AI employee is only as safe as the thing standing between it and the systems it can reach.
Identity: who is acting
An employee acts as itself, not as a shared credential. It authenticates through the same path a person does - see Sign-in and identity. The organisation it belongs to and the actor it is are separate facts, carried separately, which is what makes an audit entry attributable instead of merely present, and what stops a service credential from standing in for a person's authority on the paths where per-object access is decided.
Scope: what it can reach at all
What an employee can do is a set of skills and the tools those skills reach, scoped by role and not granted wholesale. A sales employee does not hold the platform-authoring tools: they are not in its scope, so trust does not come into it.
Underneath that sits the platform's ordinary access control: row-level rules and column masks compiled into the query plan, the same for an employee as for a person. There is no second permission model for AI to keep in step with the first.
See Skills and Tools and MCP.
The gate: what needs a person
Not every action is equal, and the difference is declared, not inferred at the moment of use.
A call classified as consequential - writing to a system, spending, reaching outside - passes through an ordered pipeline: the guardrails first, then approval. With no approver available the call is refused, and a refusal is its own recorded event, not an error string on a generic row.
That is the property worth testing in any product that makes claims like these: what happens when nobody is there to approve.
Metering: what it costs
Every model call goes through a single transport that meters it. A boundary test enforces that, not convention: a call site outside the permitted set fails the build, so there is no cheaper unmonitored path an employee could end up on.
See Budgets.
The record: what it did
Every tool call and every decision is written to the audit trail: what was asked, what was used, what it cost, what was refused and why. One trail, both kinds of actor, under their own names, which is what lets "who changed this in March" be answered without first establishing whether the answer is a person.
See Traces.
Knowledge: what it knows
An employee answers about your company because it can read your company: the catalogues, the data models, the processes, the knowledge base - retrieved by meaning, not inferred from a schema at the moment of asking.
See Knowledge and Company knowledge base.
Where the rest of it is documented
This page is the boundary layer. The machinery that runs the employees - model providers, skills, budgets, the tool surface, the decision trail - is its own block: AI harness.