An autonomous agent chooses what to do at every turn. That changes what has to be controlled: keeping outsiders out is no longer enough — you have to limit what the agent itself can reach, write and send. This page describes the controls that exist in the platform, not badges on a wall.
Security questions, data processing agreements and contract clauses: talk to the team.
In a decision-tree chatbot, everything that can happen was designed in advance: every path, every message, every query. Reviewing the design is reviewing the behavior. An autonomous agent does not work that way.
You don't control an autonomous agent by reviewing what it thinks. You control what it can actually reach: which queries exist, which tools were enabled, who an email is allowed to go to, and what the platform flatly refuses to publish.
That's why every control below belongs to the same family: closed lists, positive permission and explicit refusal — never “the agent was told not to.”
An instruction in the prompt is guidance. A control is what the platform refuses to execute.
In chat with the manager, a Squad can configure itself: learn an API, adjust its own schedule, change its core context. In a scheduled automatic run, the input is no longer an authenticated human but system data — so self-configuration is blocked in that mode. The agent executes; it does not reprogram itself.
Every item below is platform behavior, not a usage recommendation.
The agent doesn't write database queries. It picks from curated, parameterized queries written and reviewed by people, and fills in the parameters only. The set of things that can be asked is finite and known.
Permission is positive: the agent does only what has been explicitly enabled for it. A tool that wasn't turned on doesn't exist in that agent's universe — it isn't blocked after the attempt, it simply isn't there.
When a Squad spins up dozens of subagents to work case by case, they inherit read-only tools. Writing, sending email or firing a message is not part of what a subagent can do. The main agent is the one that acts.
Email only goes to addresses the manager authorized in advance. The list is checked twice: when the agent requests the send, and again right before the message leaves. An address that isn't on the list doesn't receive anything.
A document with no content, or with unfinished arithmetic inside the chart, is refused — the platform will not publish a “tidied-up” version of something that was wrong. A report that never went out beats a report that went out looking good and false.
The lock is anchored to the case being handled, not to the template name. If that customer was already notified about that case, the platform knows and doesn't push again — even if the message is recreated under another name, in another run.
Every query the agent runs against operational data is scoped to its own company and is read-only. There is no company parameter the conversation could forge: scope comes from the authenticated context, not from the text.
Before letting a routine act on its own, run it in simulation: the Squad decides and logs what it would have done, without sending anything. Once the routine is live, every run has an auditable history and a button to stop it midway.
Assigning the conversation to a rep pauses the bot in that chat automatically; closing it hands service back to the agent. There is no parallel conversation, and the history records who said what — person or agent.
The Permissions screen is where the manager decides, item by item, what that Squad is allowed to do: whatever is switched off never appears to the agent, the email recipient list is closed, and simulation mode lets the routine decide without sending anything. The run log keeps what was called, what was refused and the outcome the agent stated in writing at the end. That combination is what backs the claim that an agent deciding on its own still operates inside limits somebody set.
| # | Trigger | Stated outcome | Refusals | Started |
|---|---|---|---|---|
| 128 | scheduled | Simulation 9 notices prepared, nothing sent | 2 | today 06:00 |
| 127 | by button | Acted 6 routes flagged to the Channel Agent | 1 | yesterday 18:00 |
| 126 | scheduled | Did not act no late routes in the period | 0 | yesterday 06:00 |
| Refusals logged across the three runs | 3 | |||
In the left column, the Route Check Squad with its permission scoreboard: four on, three off. In the middle, every permission is a switch with its consequence spelled out beside it — query data, publish document, send email and the fan-out of subagents switched on; write to the system, fire WhatsApp messages and self-configuration switched off —, followed by the enabled tools, where api_post_route and api_del_order sit greyed out, and by the closed recipient list, with the partner's address marked as off the list. Underneath, the strip for run #128 shows the round in progress, the two refusals logged the moment they happened, and the stated outcome that closes out the table of recent runs.
Changing what the agent can reach is a matter of flipping a switch on this screen, not of rewriting instructions and hoping: the attempt to write to the route lands in the log as a discarded action, and the email to an address off the list is refused without anyone having had to remember to ban that address. With simulation mode on, the routine runs a few cycles deciding without sending anything, and the team reads what would have been done before the first message goes out. And when security asks what the agent did at six in the morning, the answer is the row in the table — not a reconstruction from logs.
Look at the permission to fire WhatsApp messages, switched off: it leaves no hole in the operation. The Squad sends a plain-language instruction to the Channel Agent, which is the one that talks to the customer, and gets an answer back — including a “no need, this customer already confirmed yesterday”, which the Squad accepts and records. A workflow automation fires and forgets, because it has no one to talk to; here one agent calls on another, takes no for an answer, and still writes up the outcome of the run — as in row 126, where checking and concluding there was nothing to do counts as a run carried out.
Every key carries the scopes of what it can read and what it can trigger. A key's company is always the key's own — there is no company parameter the request could supply.
Send endpoints accept an idempotency key: retrying a call after a network failure does not produce a second message to the customer.
There is a request limit per key, and the key and documentation screens are restricted to the company administrator inside the console. See integrations and API.
Hal-AI is a Meta Business Partner and runs on the Official WhatsApp Business Cloud API. The difference from unofficial automation isn't cosmetic: it's the difference between a channel with known rules and a channel that can vanish with your history inside it. 
While campaigns are running, the guardian watches the health of the number and reacts by severity: quality in the red or a fatal Meta code freezes the number and pauses its campaigns; a spam-limit signal slows the send rate; a recipient that returns an individual error goes into the cooling list and stops receiving. The screen shows how many contacts are blocked and how many come out of the cooling list soon.
There is no third-party database underneath. What the agent knows about your operation comes from two sources, both chosen by you.
One company's conversations never become another company's training material. Each agent sees only the knowledge and data of the company it belongs to — including when an agent is shared with another company on the platform, which happens only with explicit consent.
For the technology behind the memory, see the platform and the patent. For the Knowledge Vault and the tools, see channel agents.
The client company is the controller of the personal data processed in its operation: it decides the purposes and the means of processing. Hal-AI acts as the processor, handling data according to the client's instructions and the terms of the contract.
| Decision | Client company (controller) | Hal-AI (processor) |
|---|---|---|
| Purpose of processing | Defines what the data is used for in the operation | Processes according to the instructions received |
| Legal basis for processing | Chooses it and answers for it | Does not define a legal basis on the client's behalf |
| What the agent can reach | Registers the APIs, uploads the knowledge, enables the tools | Provides the controls that limit that reach |
| Data subject rights | Is the point of contact for the data subject | Supports fulfilling the request through the contact channel |
| Retention period | Sets the period that applies to its business | Applies the period defined in the contract |
| Subprocessors and annexes | Approves what the contract covers | Operates within what was contracted |
Requests for access, correction or deletion arrive through the client company's contact channel and are handled as the contract establishes. Talk to the team.
Conversations, call transcripts and published documents stay in the client company's account. The retention period is the one defined in the contract — no default period is announced on this page.
Operational auditing uses work telemetry — presence, focus, breaks, cards received. Capture never records mouse coordinates, only flags and counters, and the monitoring notice shown to the operator is configurable by the company.
Specific clauses, data processing agreements and technical annexes are handled in the contract, case by case. This page describes product controls and does not replace the contractual instrument.
It's worth saying this in the negative, too.
Your operational data is never sold, transferred or offered to third parties. It exists on the platform so your company can run.
The history, memory and knowledge of one company never feed another company's agent on the platform.
WhatsApp campaigns run on the official channel, with approved templates and within Meta's rules. When Meta flags a problem, the platform slows the pace or freezes the number — even against the campaign's wishes.
The agent has a name and a personality, but asked directly whether it is a person, it says it is an artificial intelligence agent. And human service is one supervisor click away.
Half of control is configuration. These are the decisions that stay with your team.
An agent that never has to fire a template shouldn't have that tool turned on. Start with the minimum and expand when the operation asks for it.
The credential you register as a tool defines the agent's real reach into your ERP. Prefer a read-only user and specific endpoints.
The closed email list is what keeps a report from reaching the wrong person. Treat it as critical data and review it whenever someone changes roles.
Let the Squad decide without sending for a few cycles and read what it would have done. Fixing an instruction is cheaper than fixing a message already sent.
Indexed content is what the agent will use to answer. An internal document that must not be revealed to a customer does not belong in that agent's Vault.
API keys, channels and agent configuration belong to the company administrator. Keep that group small and review access as often as you do for your other systems.
No. The agent picks from curated, parameterized queries written and reviewed by people, and fills in the parameters only. Every read is scoped to its own company and is read-only.
Email delivery only accepts addresses from a closed list registered in advance by the manager. The list is checked twice: when the agent requests the send, and again right before the message goes out. An address that is not on the list is never emailed.
This page describes controls, not badges. Security documentation, vendor questionnaires and contract clauses are handled directly with the team, inside the sales process. Talk to a specialist and tell us what your security team needs to assess.
The client company is the controller: it defines purposes and means. Hal-AI acts as the processor, handling data according to the client's instructions and the contract, retention period included.
No. Asked directly whether it is human, the agent says it is an artificial intelligence agent. And at any moment a rep can take over the conversation — the bot is paused in that chat automatically.
Yes. Every Squad run has an auditable history and a button to stop it. Before that, simulation mode lets the routine decide and log what it would have done without sending anything. See how Squads work.
Access belongs to your company and follows the console's roles: administrator, supervisor scoped by queue, and operator. API keys and technical documentation are restricted to the administrator. See roles and operational auditing.
Vendor questionnaires, data processing agreements, retention clauses and the design of the controls for your operation: we cover all of it in the sales process, with people who know the subject on both sides.