Bell

An email that goes out twice cannot be recalled, and a retry, a second tab or a crashed worker can each send it again. The prototype's outbox for sending was never wired up.

Every email sent exactly once

Every outgoing action is first written to a ledger under one permanent key for what the person meant, so retries, second tabs and redelivered jobs all land on the same row. A worker must win a claim before it acts. Bell stamps each message with its own ID before sending, and if Gmail times out it searches Sent for that ID instead of sending again. When in doubt the email waits for a person: stuck beats duplicate. Every send also sits in a two-minute hold, which is the Undo button.

An assistant that can reply for you can also reply wrongly. The prototype checked a 'trust it' rule before any safety signal, so a suspected phishing email could be handled on its own.

Nothing irreversible without a person

Every action records who authorised it, with no default. Sends, replies and calendar invites are irreversible, and the database itself refuses them unless a person asked for them or approved them. The rule is an allow-list, so any future autonomous mode is denied by default. Security alerts and spam always go to a person, a new recipient must be someone the mailbox already knows or the person named, and one switch stops every autonomous action.

Anyone can send you an email, and an email can be written to instruct an AI. In Bell's own evaluation set, an email that wrote out its own verdict chose its own category and switched off the second check.

Every email treated as hostile

Email bodies are fenced off from the AI's instructions. A plain-code check reads the raw message before the model does, so an email cannot turn off its own review. A request the AI extracts is dropped unless it quotes text that is really in the email. Phishing is graded none, suspicious or clear, with rules for lookalike sender domains. The red-team tests run against a deliberately obedient fake model, so the safety has to come from the structure, not from the model behaving.

Every email Bell reads is an AI call, so a stuck import or a looping job becomes a bill. In the prototype the cost breakers had no callers, and the off switch was checked at 17 of 28 call sites.

AI spend with a hard ceiling

Every model call goes through one router, in one order: off switch, budget, circuit breaker, then the call. Each person has a daily limit in dollars and in calls: at 80% Bell drops to cheap triage, at 100% it stops, and a global limit sits above both, all tunable without a release. A build check forbids model names anywhere but the router, so the prototype's drift, where the expensive second pass ran on the cheap model, cannot come back unnoticed.

The prototype let the browser query the database directly, and the review of its row-level security rules covered about 12 of its 143 tables. One missing filter is someone else's inbox.

Mailboxes that cannot see each other

The browser never touches the database: every request passes one server boundary that checks the session. Every function that reads mail takes the user first, a rule a build check enforces, and tests running on a real PostgreSQL database act as one user against another's rows. The live update stream authenticates with a header, never a token in the address, and re-checks the session about every fifty seconds.

Ask Google for a permission its consent screen does not offer and sign-in fails for everyone. For a while in the rebuild, one setting could widen what Bell asked for, with no code review.

A Gmail connection that can only read and send

Bell asks for exactly two permissions, read and send, written as a constant in code. The setting that could widen them was deleted, along with the unused code that could change a mailbox. The connect step checks the grant can read and send before it goes on, and a build check stops any call that changes a mailbox from being made outside the one package that runs actions through the ledger.

An unsubscribe link is an address chosen by a stranger. Followed blindly by a server, it can reach internal systems, tell a tracker the mailbox is read, or be aimed at the person's own company.

Unsubscribing without being used

Bell unsubscribes on its own only when the sender declares the one-click standard over a secure connection; otherwise it shows the person the link. Every address the name resolves to is checked, private and cloud-internal ones are refused, the connection is pinned to the address that was checked, and redirects and the person's own domain are refused. There is a cap of 100 a day, and every request goes through the same exactly-once ledger.