Security & governance

Autonomous agents,
with limits you can
see, audit and change.

Letting software act on your marketing channels only works if control is built into the architecture. Governance in ShiftMetrics is enforced by the platform, not left to convention.

Talk to us about security →
3 permanent human gatesRow-level isolationAppend-only audit log

Five layers
between an agent and the outside world.

Each layer is independent: a failure in one does not remove the others.

Permanent human gates

Publishing content, launching campaigns and responding to complaints always require a person. These three gates cannot be overridden for any account.

Governance

Per-account autonomy policy

Each account defines which operations each agent may run on its own and which need approval. Teams approve categories of action, not individual tasks.

Governance

Row-level data isolation

Every account-scoped table enforces row-level security. A missing or incorrect account context returns zero rows rather than another account’s data.

Data

Scoped connectors

Search, ads, analytics and CRM platforms connect through a connector layer. Every connector is scoped and credential-managed per account.

Access

Circuit breaker per agent

A per-agent circuit breaker is the last safety layer before any external API call, stopping an agent that misbehaves before it reaches a customer-facing system.

Safety
Accountability

Every action
leaves a record.

What happens each time an agent wants to act on a connected system.

  1. 01

    Policy check

    The action is checked against the account’s autonomy policy and the three permanent gates.

  2. 02

    Approval, when required

    Gated actions wait in a queue for a named person. Nothing proceeds on silence.

  3. 03

    Idempotent execution

    Actions that cross a system boundary are auditable orchestration steps designed to run once — no double-publish, no double-charge.

  4. 04

    Append-only audit log

    Outcome, agent, account and timestamp are recorded in a log that is never edited in place.

Security questions

What teams ask us first.

Can an agent publish or launch something without approval?
No. Publishing content, launching campaigns and responding to complaints are permanently human-gated for every account.
Could one customer’s data appear in another’s account?
Account isolation is enforced in the database by row-level security, so a query without a valid account context returns no rows.
How do I review what the agents did?
Every agent action is written to an append-only audit log, so activity can be reviewed after the fact.
Who do I contact about a security question or disclosure?
Write to dev@shiftmetrics.co.
Design-partner program

Help us take the agents
to production.

We are opening a design-partner program: we connect to your real channels, set your governance rules and run the first agents with you, side by side.

Request early access →

Tell us about your channels and we will get back to you.