Guardrails

These are the rules every enoki action runs under. They’re enforced in code, not left to the model’s judgement.

No free-form execution

No tool accepts an arbitrary command, shell string, or writable SQL. Every GCP operation is a named tool with typed, validated fields — there is no run_gcloud(command) and no passthrough. The single place SQL is accepted at all, run_bigquery_select, is parsed and refused unless it is one read-only SELECT, then dry-run cost-capped and row-limited — so a query can never become a mutation. If a capability isn’t an enumerated tool, enoki can’t do it, by construction.

The model never authorizes

The language model produces a proposal, never a side effect. Read tools run under your identity; write tools return a deferred request that pauses the run. The model has no path to a mutation except through an approval you grant.

Your identity is the ceiling

Every GCP call runs under your Google credentials — never a shared bot admin account. Your IAM roles are the boundary: enoki can do exactly what you can do, and nothing more. GCP’s own IAM is the final gate and it fails closed — if you lack a permission, the call is refused at Google, not by a check enoki could get wrong.

Consequential actions need a human

Create, delete, start, and stop all pause for an explicit Approve / Deny in the thread. Approvals are rendered per call (approve some, deny others), are single-use, and only resume the run once every pending call is decided. Nothing consequential happens “to save a click.”

Zero data at rest

enoki persists no Slack message text, channel names, or file contents. Conversation context lives in memory with a short TTL and is re-fetched live, not stored. The only durable state is your encrypted Google refresh token and the audit trail.

Everything is audited

Each GCP tool call is recorded: Slack user, Google email, tool, read-or-write, arguments, and result — including denied approvals. The trail is structured and append-only.

Least authority by intent

The highest-blast-radius operations are simply absent. There is no IAM or billing write tool, because a generic approval button is the wrong control for them — they’d need dedicated, resource-level guardrails first. Leaving them out is the safe default.

Next: Setup — connect enoki to Slack and Google Cloud.