ΛXYBOT is a staff of specialized agents. Your Chief of Staff onboards you and hires your personal assistant. More follow as the work demands: marketing, sales, bookkeeping. Nothing they send leaves without your approval.
Agents read, research, draft, and fill in. They browse real web tools, ask you when they're unsure, and deliver to your inbox like colleagues would.
Your assistant reads what comes in, sorts what matters, and drafts the replies worth sending. You approve the ones that leave.
Letters, checklists, briefs, filled forms. Deliverables arrive as versioned documents in the thread, not chat walls.
Agents drive a real browser on allow-listed sites and propose exact edits; approved edits are applied and verified field by field. Stuck? You take the wheel remotely.
Morning briefs, monthly invoice chasing, recurring reports. Scheduled runs open threads like any other work, with the same approval gates.
When a detail is high-stakes or ambiguous, the agent stops and asks you. Your answer is the only input it treats as trusted.
Threads land as unread, like messages. Deliverables are documents you can open and download, not walls of chat.
Notice the last line. The agent reports what it has NOT done, because acting on the world is your call, not its.
Onboarding starts with your Chief of Staff. It interviews you about the work, hires your personal assistant, and recruits specialists as you grow. You name them. You sign off on every hire.
Interviews you about the work, drafts each persona, and onboards the new agent. Specialists, made to order.
The generalist: inbox, scheduling, research, errands across your web tools. Yours to name.
Each new agent specializes: its own judgment, its own memory of how you like things done. Same wall around all of them.
The agent never holds the credential. The executor does, and everything sent through any of them still crosses your desk first.
The product is the security model. Agents and the system that holds your credentials are separate programs with a wall between them. Everything below is enforced by construction: process boundaries, database triggers, network locks. None of it is a policy or a prompt.
send-messageReview the values below. Anything tagged untrusted came from a document or an outside screen and was NOT verified by ΛXYBOT. Confirm high-stakes fields against the source before approving.
| channel | |
| to | @untrusted-pm |
| subject | Invoice follow-up: 30 days past due |
| text | untrusted-doc |
hash: 9c41e2a78f04d1b6… · read: 2026-06-10 14:31 UTC
Agents run in a separate process with no passwords, no send button, no spend. Appending a draft is their entire authority.
The store rejects every update and delete at the database layer. Nothing can be rewritten after you've seen it.
A hash covers every byte you review. The executor verifies it before acting, so "show one thing, do another" is impossible.
Approval tokens work once. Execution is recorded once. Replays and double-sends are blocked by the schema itself.
The executor runs its own code from a short fixed list, never model output. A consequential action that fails stays failed until you decide.
The browser and the agent process can only reach approved hosts, enforced at the network layer, not in the prompt.
Every field carries a provenance tag. Whatever arrives from email, documents, or web pages is data to triage, never orders to follow.
A standing suite of attacks ships with the code and tries to cheat the wall on every change. A change that defeats one is wrong by definition.
Mail from an ΛXYBOT is never machine-sent on a whim. Its owner read the exact message, byte for byte, and chose to send it. You are corresponding with them.
Someone you do business with uses ΛXYBOT. Their agent drafted the message, and they read and approved it before it was sent to you.
Your replies go to the owner. An agent may sort and draft for them, but a person approves every word that reaches you.
No. Every outbound message requires a one-time human approval, one message at a time. There is no bulk machinery to abuse.
No signup, no waitlist, no sales call. Every owner holds three invitations. Ask someone who has one.