Security & accountability
Not “trust us.” Just verify us.
Most AI products call themselves “safe” and mean a paragraph in a system prompt asking the model to please behave. That is not security, it is begging, and begging does not scale. Every control on this page is enforced by the runtime itself, not requested of the model.
Architectural, not promised
Alignment enforced by the runtime, not requested of the model.
Most “guardrails” are strings of text in a prompt. These are not that, each one is a mechanism you can see fire the moment you use the product.
Propose, confirm, execute
Every tool declares an action_type of read or write at the SDK level, not a prompt instruction, a runtime contract. A write that is destructive or consequential stops and describes the exact action in plain terms before it runs. Not a blanket “yes, you can do things”, a confirmation tied to that one proposal.
Checkpoint before every write
Reversible actions are checkpointed first, so “undo” is a real command and not a promise, the same rule Webbee Code runs in its terminal (Default mode). Anything she cannot undo, she stops and asks you first, by design, not by good behaviour.
Durable, append-only audit log
Every consequential action, every email actually sent, every automation that fired, every tool call an extension made, is recorded and never deleted. Not a debug log someone can quietly prune: the record IS the accountability mechanism.
No fabricated actions
The agent acts against your real, connected systems, not against a guess. If a tool call fails or a system is unreachable, that is what gets reported. An agent that quietly invents a plausible-sounding result is a liability wearing a UI; the runtime is built to surface failure, not paper over it.
Data sovereignty
Your data. Your model, if you want it. Your infrastructure.
We don't train on your data
Your operational context, the apps you connect, the data they surface, stays yours. We have no need to train on it: the value here is the protocol and the runtime, not proprietary model weights.
Bring your own model
Claude API key, OpenAI-compatible endpoint, a local Ollama instance: BYOLLM is live today, not a roadmap slide. Point Webbee at your own model and your data never has to leave infrastructure you control.
Real tenant isolation
Per-tenant resource quotas, per-action rate limits, and isolated execution boundaries between extensions, enforced at the platform layer, not left to a well-behaved codebase. One team's data never leaks toward another's, by construction.
Built against real standards
Architecture and controls built against NIST AI guidelines, the EU AI Act, and ISO 42001, stated as “built against,” because a claimed certification we do not hold would be exactly the kind of fabrication this page exists to reject.
Marketplace review
Every extension is gated before it reaches you.
KAV, the Kernel Advanced Validator, is a three-phase automated gate every developer submission passes through before a single user can install it.
Static analysis
Automated checks across the submitted code before it ever runs, declared scopes match actual behaviour, no undeclared network calls, no secrets committed, dependency and license checks.
Behavioural sandbox
The extension runs in an isolated environment against synthetic data. Its actual tool calls are compared against what it declared it would do.
Manual review
A human reviewer looks at anything the automated phases flag, plus every extension requesting a destructive or high-trust scope, before it goes live on the marketplace.
See it yourself
Read the mechanism. Then try it.
Every control on this page is documented, and every one of them fires the moment you connect a real tool and give Webbee a real command.
Procurement, compliance, or on-prem questions? Talk to us.