The Empros Standard.

I Identity

Every agent is a named actor with its own service identity and its own scoped credentials. There are no shared keys and no human accounts reused by software. Each credential maps to exactly one agent and one client environment.

• Per-agent service identities in every connected system, provisioned at build, revoked at decommission.
• Credential scope is the narrowest the work allows; scopes are reviewed when an agent's duties change.
• Every entry in the audit record carries the acting identity. "Who did what" is a lookup, not an investigation.

II Permission

Default deny. An agent can take only the actions inside its explicit grant — these systems, these actions, these amounts, these hours. Anything outside the grant is refused at the platform layer, before any model output can act. An illustrative grant for a document-collection agent:

Grants are written artifacts, versioned per fleet, and reviewable by the client at any time.

III Approval

Sensitive actions wait for a human yes. The gate lives in the architecture, not in the model's instructions. Four gate classes ship with every fleet:

• Financial — any movement of money, refund, credit, or payment instruction. Always gated.
• Contractual — quoting terms or pricing, making commitments, anything that binds the client. Always gated.
• Outbound at scale — sends beyond a per-client volume threshold. Gated.
• Novel action — the first occurrence of an action class the fleet has not performed before. Gated until explicitly granted.

Approval requests land in a queue on the client's channel of choice, with an escalation path defined during the build. Unactioned requests expire; nothing auto-approves. Response-time targets for gated work are set per client in the Operate SLA.

IV Record

Every action, approval, and refusal is written to an append-only audit log: acting identity, action, target system, timestamp, outcome, and — for gated actions — the approver by name. The log is written by the platform layer; an agent cannot edit its own record.

• Retention spans the engagement plus a horizon configured with the client.
• The client can read and export the log at any time; a full export is a standard part of offboarding.
• The record is formatted to be handed to an auditor without preparation.

V Consent

Outreach and voice ship with consent machinery as standard equipment, not configuration options: consent capture at first contact, plain AI disclosure on every voice interaction, immediate opt-out, and suppression lists that propagate across channels and survive data refreshes. The posture is engineered to the strictest current reading of the TCPA and the FCC's artificial-voice rulings — which makes it lawful in rooms far less regulated than that.

— The floor

The articles are the ceiling Empros holds itself to. Beneath them, the security fundamentals — stated with their status, never overstated:

— Data posture

Each client fleet runs in its own environment: separate credentials, separate stores, separate model contexts. Nothing trains on client data. Nothing crosses between clients. That sentence is a covenant in the contract, not a description of current settings.

Where a client competes with a company Empros operates — including the founders' own — the engagement runs under a no-cross-pollination covenant, with the option to deploy inside the client's own cloud environment where required.

— Commercial honesty

The architecture is documented and portable: export rights and transition assistance are in the MSA before signature, and fleets are built across model vendors rather than welded to one. Model and API costs pass through at cost, in writing, in both directions — when providers cut prices, the client's bill follows.