What Dustav never does

An agent in your business inbox earns trust by what it can't do, not by what it promises. Dustav's fences are structural — enforced where the code executes, not requested in the AI's instructions — and this page is the list. Our design rule when adding any capability: the safest power is the one we never grant.

Never sends without you

Dustav drafts every reply; it sends none of them. There is no code path from the background reader to an outbound email — a send happens only when you click it, after a visible undo window (or at the time you scheduled it for). The same fence covers everything send-shaped: a calendar invitation, an RSVP, an update to a meeting's guests, a forward — each one is staged, labelled with who it will reach, and goes out only on your tap. Nothing reaches another human being without your commit. You're the one who hits send.

Never writes your calendar

Every date is a proposal until your tap books it. Dustav has no autonomous write to your Google Calendar — not from the reader, not from chat. An event with guests is no exception, just a louder button: the chip says "Save & email 3 guests" so you know exactly who hears about it, and there is no silent version. The calendar.

Never fills a table from its own imagination

Rows from your mail are written only by a sealed extractor reading the actual email against your rule. The Dustav you chat with never fills a table in bulk or volunteers values of its own: it changes one row at a time, only when you ask, and every change, yours or its, is kept in the row's history with who made it and why. A number in your table traces to the email it came from, or to the person who changed it. Table workflows.

Never builds a second home for your mail

Your mail's canonical store is Gmail, full stop. Dustav files with your labels, drafts into your Drafts, sends through your send — its own additions are the understanding layered on top. Disconnect it and every email, folder, and sent reply is exactly where Gmail always kept it. No migration in, no hostage on the way out.

Never spends past your balance

Every piece of work — background reading included — debits your prepaid balance and stops when it's empty. There is no unbounded loop that bills you while you sleep; the worst case is bounded by money you already chose to put in. How billing works.

Never becomes a Someone

Dustav has a fixed name, a fixed voice, and a job. There's no persona to configure, no relationship to maintain, no simulated feelings bidding for your attachment. It's a sharp operator, not a companion — by conviction, not by omission.

Why "enforced in code" matters

A hostile email can ask Dustav for anything — that's what prompt injection is. The reason it's not lucrative here is that the model doesn't hold the powers worth hijacking: the email that says "wire the deposit today" can, at absolute worst, produce a draft you'll read. Guarantees that depend on the model's in-the-moment judgment are hopes; these fences don't. (Security posture continues this thread.)