Supervised by default. Four locks you cannot enable.

What are Nerxus One guardrails?

Nerxus One guardrails are the enforced rules that sit in front of every agent dispatch: Supervised as the default Agent Mode, an Autonomy Matrix per agent and per action, four locks you cannot enable, and a kill switch that precedes everything else. They live in Settings, AI Agents, and in Automation, Guardrails. They are the same rules the chat panel uses.

A policy PDF is not a guardrail. A banner you can dismiss is not a guardrail. The product treats the four locks as fields on the channel and the tool, so a later channel cannot slip past a switch that forgot to name it. automation_gate() is the decision-time function. send() in outreach cannot run without a branded gate verdict.

The buyer is the marketer who will lose a domain or a client if this layer is theater. We will not print a SOC 2 badge on this page. We will print the locks that already exist in the app. If you need a badge wall, wait until those audits are true. Kickoff should say the four locks out loud. A playbook cannot smuggle a red step. Forms and the SMS lock stay the same story. Most-restrictive-wins is the resolver.

Guardrails also cover spend and volume. Per-tenant keys mean autonomy spends your Places, your model budget, and your Resend, never a platform pool. A missing key disables the dependent step and should surface in the briefing. Falling back to a hidden platform key so a demo looks alive is the same class of lie as a green check on unknown data.

What does Supervised by default mean?

Supervised by default means a new tenant starts with Agent Mode set to Supervised, so agents may search, scan, draft, and score, and they wait for a human before they send, publish, or spend. Onboarding is supposed to leave you in that state. It is the opposite of a zero-approval-click pitch.

Off is a real third state. It stages work and runs nothing until you switch. Autonomous is a permit, not a personality change. Turning the top-bar pill to Autonomous does nothing by itself. It only allows playbooks you have enabled and scoped to run inside caps and windows.

The pill and the Guardrails page write the same workspace setting. A client-only copy that diverges from the row is a defect. If the bar says Supervised and a playbook sends, that is a bug, not a growth feature. Most marketers should live in Supervised for the first month even after they like a dry run.

What is the Autonomy Matrix in Nerxus One?

The Autonomy Matrix is a grid with one row per agent action and one of three levels in each cell: Autonomous, Supervised, or Off. Scout.search can sit at Autonomous. Relay.send starts at Supervised. Forge.deploy starts at Supervised. Muse.publish starts at Supervised. Echo's low-star reply stays held.

Read-only work may default green. Anything that leaves the building or spends money defaults amber until you opt that cell up. The matrix is visible. Locked rows show a lock icon and stay disabled. Hiding a banned action so the grid looks cleaner is how operators assume it might be available in a later menu.

Resolution is most-restrictive-wins. A playbook that says autonomous cannot raise a cell the matrix left supervised. A matrix cell set to autonomous still dies at a lock, a kill switch, a cap, a quiet hour, a missing scope, or a global Off. The gate logs which rule fired. Activity has a column for that decision.

What are the four locks I cannot enable?

The four locks you cannot enable are cold voice, cold SMS, review gating, and email without a verified domain. They are platform locks, not tenant preferences. There is no UI path to turn them on, and no code path that forgets to check them if a new channel is added later.

Cold voice means there is no outbound AI call to a prospect. Forge's voice tool is inbound only. A demo number for a pitch and a live line after they pay are the allowed shapes. Cold SMS means you cannot text a discovered list. SMS requires first-party, timestamped, channel-specific consent from Forms, on a registered A2P 10DLC number.

Review gating means the public collect page always shows public review buttons. Email-first means Relay cannot transmit until the tenant's Resend domain is verified. Unverified is a blocking gate on the outreach feature. Drafts can exist. Sends cannot. Those four map to the red rows people look for when they ask whether this is an AI SDR.

Why is email blocked without a verified sending domain?

Email is blocked without a verified sending domain because outreach is email-first and the send must leave from the tenant's own Resend domain, not a shared platform identity. Your domain, your warmup, your reputation. The platform owner does not burn your quota. You do not burn a client's.

ComplianceGate checks more than the domain. Physical address, unsubscribe, spam-lint, quiet hours, and stop-on-reply are draft-time and send-time rules. The domain check is the one that fails closed before any of those matter. A pretty template on an unverified domain is still a blocked send.

Marketers sometimes want a shared inbox to try the motion. That trial still has to verify a domain you control. We will not offer a silent skip so a demo looks finished. If you are on the waitlist, you can read senders and outreach now. You cannot send from this marketing site.

Why are cold voice and cold SMS locked in Nerxus One?

Cold voice and cold SMS are locked because those channels need prior express consent the product cannot honestly claim from a public listing. A Google Places row with a phone number is a listing. It is not an opt-in. Treating it as one is how agencies collect TCPA exposure and carrier bans.

Inbound voice is the safe side of the line. The agent answers the owner's number, discloses that it is AI where the deploy requires it, and books or messages inside that conversation. That deploy is still amber. It is not a lock. The lock is the missing outbound cold path. You will not find a click-to-dial blast in Forge.

SMS has a narrow on-ramp. The Forms consent checkbox cannot be pre-checked and cannot be bundled into a required service-consent line. Publish lint blocks that form. Client SMS after a signed relationship still needs the opt-in on the contact. Dunning and win-back stay email-first. There is no aggressive automated voice or SMS collection path.

Why is review gating locked?

Review gating is locked because the public collect page must show public review-platform buttons to every visitor, with no conditional branch that hides them after a low-star tap. Private service-recovery can sit next to that path. It cannot replace it. Echo is built on that rule.

There is no disable filter toggle. There is no settings row that says hide Google if they pick one or two stars. A marketer who wants that workflow should use a different product and own the complaint. We will not ship the branch and then claim the lock in marketing.

Yelp and Tripadvisor remain monitor or assisted. That is a capability tier, not a gating story. Assisted means you copy and paste with a draft. It does not mean Echo can hide a button. Google, Facebook, and Trustpilot still need live credentials before anyone should quote live replies. Until those are exercised, say unknown.

What is the kill switch and when does it fire?

The kill switch is Pause All on Mission Control and Guardrails. When it is on, the gate refuses every autonomous dispatch before matrix, caps, or mode are considered. In-flight steps are supposed to stop at the next boundary. The UI stays reachable so you can resume named playbooks later.

Circuit breakers sit next to the switch. A streak of compliance blocks, an error-rate spike, or a cost spike can pause a playbook without waiting for you to notice. The briefing should name the breaker. A silent pause that looks like a healthy idle is a defect.

Chat can pull the same lever. Turn off the storm playbook pauses that playbook and tells you how to resume. That is not the global kill switch. Use Pause All when you want the whole overlay quiet. Use the per-playbook pause when one motion misbehaved.

How do spend caps, send windows, and circuit breakers work?

Spend caps, send windows, and circuit breakers are the tunable layer on top of the locks. You set a tenant autonomous budget, per-playbook ceilings, and a per-action micro-threshold. Projected cost is reserved before dispatch. Actual cost is written after. Missing provider cost does not become a invented zero.

Send windows and quiet hours are timezone-aware. A pass in one region can be a queue in another. First-run approval stays on for amber sends until you turn that guardrail off for a named audience. Dry-run-first is the default when you enable a playbook that contains an amber step.

When a ceiling is hit, the playbook pauses at the next step and says so. Cheap green monitoring can keep running under its own envelope so Watchtower does not go dark because a build budget was spent. Caps spend the tenant's keys. The platform owner does not fund your overnight experiments.

Where do I set Agent Mode and the Autonomy Matrix?

You set Agent Mode in the top bar and again on Automation, Guardrails. You set the Autonomy Matrix under Settings, AI Agents, with the same four locked rows rendered disabled. M11 shows the master switch and base caps and deep-links to the full cockpit so you are not maintaining two stories.

Per-playbook policy lives on the playbook detail: level, scope, caps, schedule, quiet hours, first-run approval, dry-run-first. Scope is the leash. Saved lists, clients, verticals, metros, signal predicates, and hard exclusions. Exclusions always win. A subject outside scope cannot be touched, even if the matrix cell is green.

Every change is audited with who and when. If two people share a tenant, you can see who raised Relay.send. That row is how a small team keeps one Nova without colliding. Roles still matter. The matrix is not a substitute for who is allowed to approve.

What happens when a lock or the gate fires?

When a lock or the gate fires, the action is blocked or queued, an autonomous_activity row is appended, and the operator sees the rule, not a generic failed. RED locks block. Amber over policy queues. Green that lost a key fails closed and names the missing connection.

Approve on a queued item re-checks the gate before dispatch. A domain that expired between draft and approve still fails. Edit merges your reviewed input and then re-checks. Reject blocks the staged execution and down-weights that procedural pattern. Snooze stores a resurface date of one to seven days. A toast that merely hides the card is not a snooze.

This is the difference between a referee and a suggestion. The gate can be correct and still unused if nothing is dispatched. That is the runner gap on automation. Guardrails can still be true while overnight dispatch has not run in production. Do not read a lock icon as proof that last night already mailed.

How are these guardrails different from a compliance checkbox?

These guardrails are different from a compliance checkbox because the banned actions have no enable path, the send function cannot typecheck without a gate verdict, and the collect page has no gating branch to forget. A checkbox is a statement. A branded type and a missing branch are structure.

We still will not claim we have made you legal in every metro. CAN-SPAM elements, PECR, and A2P registration are yours to complete. The product refuses the shapes that have no honest consent story. It does not replace counsel. Compliance fixer drafts in Forge stay labeled professional review recommended.

If you need a page for procurement, send them here and to senders, forms, and reputation. If they ask for a SOC 2 or HIPAA badge, the honest answer is that we will not print those words until they are true. The four locks are already true.

Forms are part of this story even though they are a kernel surface, not an agent. The consent checkbox is the only path a compliant SMS list can be born. Pre-checked is impossible. Bundled marketing opt-in on a required service line is a publish block, not a warning. If that lint ever became a warning, the SMS lock would be theater.

Who these guardrails are for

These guardrails are for a marketer who wants agents on the book without handing them the domain, the SMS brand, or the review-collection lawsuit. Solo operators need the defaults. Small teams need the audit of who raised a cell. Agencies need the tenant wall so one book cannot borrow another book's sender.

If you want maximum send volume and you already run a separate inbox rotation shop, you may find Supervised slow. Instantly is better at that single job. If you want an AI closer that calls the list tonight, this page is a no. If you want inbound voice after they pay, read voice.

Careful is the posture we will keep in public. The matrix can grow more autonomous cells as you trust a motion. The locks do not grow. That is the trade. Get started if you want into the next batch. We will not invent a price to make the locks look like a paid tier.

How the gate resolves a dispatch in order

The gate resolves a dispatch in a fixed order: platform locks first, then the kill switch, then per-capability policy, then spend and volume caps, then master Agent Mode, then scope membership. The first restriction wins. A green-lit autonomous action is one that survived all six. Everything after a lock that is not red still has a home in the approval queue with the failing reason attached.

Subject suppressions sit with scope. Do-not-contact, already-contacted-within-N-days, and per-subject opt-outs override inclusions. A playbook that matches a vertical and metro still cannot touch a suppressed shop. That is how you keep a reply of unsubscribe from becoming next week's clever follow-up.

Jurisdictions can escalate a tier. They cannot relax one. An amber email to a named sole trader under a stricter regime can queue when a corporate inbox would have passed. An inbound agent deploy can require AI disclosure. The operator cannot disable disclosure for an EU-scoped subject. The floor is the lock table. Context only raises it.

Common mistakes when setting agent autonomy

The first mistake is flipping Agent Mode to Autonomous on day one and assuming the locks got quieter. They did not. You only permitted playbooks you have not scoped yet. Dry-run the overnight loop. Read the tier ribbon. Then enable one green motion.

The second mistake is treating a discovered phone column as a texting list. Nova will refuse. Do not open a personal SMS app next to Scout to get around the lock. That bypass is yours, and it is still cold SMS.

The third mistake is building a collect page elsewhere so you can gate. Echo's page exists because the branch is absent. The fourth is sending from a mailbox that is not the verified domain because Relay felt slow. The gate is the product. Skipping it is how you become the incident the activity log was designed to prevent.

A fifth mistake is raising every matrix cell to Autonomous because the grid looked timid. Raise Scout.search if you want. Leave Relay.send, Forge.deploy, and Muse.publish amber until you have approved a week of artifacts and liked them. The grid is not a score. Empty green is not maturity.

How does most-restrictive-wins resolve two conflicting settings?

Most-restrictive-wins resolves two conflicting settings by taking the first refusal in a fixed order: platform locks, kill switch, per-capability policy, spend and volume caps, master Agent Mode, then scope membership. A playbook that says autonomous cannot raise a cell the matrix left supervised. A matrix cell set to autonomous still dies at a lock.

Subject suppressions sit with scope. Do-not-contact, already-contacted-within-N-days, and per-subject opt-outs override inclusions. A playbook that matches a vertical and metro still cannot touch a suppressed shop. That is how unsubscribe stays next week's non-event instead of a clever follow-up.

Jurisdictions can escalate a tier. They cannot relax one. An amber email to a named sole trader under a stricter regime can queue when a corporate inbox would have passed. An inbound agent deploy can require AI disclosure. The operator cannot disable disclosure for an EU-scoped subject. The floor is the lock table.

The gate logs which rule fired. Activity has a column for that decision. If two surfaces disagree about why a send waited, that is a defect. A banner you can dismiss is not this resolver. automation_gate() is.

What does a jurisdiction escalation change on an amber send?

A jurisdiction escalation changes an amber send by raising the tier or forcing a queue when the subject sits under a stricter regime, without ever lowering a lock. Quiet hours can shift with timezone. A pass in one region can be a queue in another. First-run approval can stay on for a named audience you have not mailed.

Disclosure can become required on an inbound voice deploy. The operator cannot turn that sentence off for a shop in a place that demands it. The lock table is still the floor. Context only raises it. Cold voice and cold SMS do not become available because a metro felt aggressive.

This is not a claim that we have made you legal in every city. CAN-SPAM elements, PECR, and A2P registration are yours to complete. The product refuses the shapes that have no honest consent story. It does not replace counsel. Compliance fixer drafts stay labeled professional review recommended.

If procurement asks whether escalation is a residency badge or a SOC 2 control, the honest answer is no. It is a gate rule. Print the locks. Point at senders, forms, and reputation. Do not invent a certificate to make the escalation sound finished.

How do Forms and the SMS lock stay the same story?

Forms and the SMS lock stay the same story because the consent checkbox is the only birthplace of a compliant SMS list, and a discovered phone column is never that birthplace. The checkbox cannot be pre-checked. A bundled marketing opt-in on a required service line is a publish block, not a warning.

If that lint ever became a warning, the SMS lock would be theater. Scout can store a number it saw on a listing. Memory can remember the number exists. Neither object is consent. Nova should refuse text everyone on the Austin list before classify tries to be helpful.

Client SMS after a signed relationship still needs the opt-in on the contact. Dunning and win-back stay email-first. There is no aggressive automated voice or SMS collection path. Steward can draft a pay-link mail. It cannot grow a text rail to look modern.

A teammate who imports a spreadsheet of numbers into a personal text tool is not a Nerxus workflow. We will not bless that loophole in a kickoff. The lock is the sentence the intern needs when a client asks to have the robot text the list.

What should a kickoff say about the four locks?

A kickoff should say the four locks out loud: no cold voice, no cold SMS, no review gating, email only after the gate on a verified domain. Workshops that hide those sentences create clients who will ask you to break them on week three. The product will not grow a toggle later because a QBR was awkward.

Show the collect page. Public buttons stay public. Private recovery sits alongside. If they ask to hide Google from unhappy visitors, the answer is no. Show senders. Unverified is a block. Relay can draft. Relay cannot send. Show voice as inbound only. A demo number is a pitch. A live line waits until they pay.

Supervised as default is the next sentence. Autonomous is per action. Flip it when you can describe the blast radius. Overnight dispatch is a separate half. Governance is live. Do not tell the room a playbook already mailed if the runner is still open.

If the book is medical, add the EHR and HIPAA refusal in the same type size. If the book is a firm, add the no-blast opening. If the buyer wants a dialer, lose the row. The locks are why you can sell agents on the book without handing them the domain.

How does the gate treat a playbook that wants a locked action?

The gate treats a playbook that wants a locked action as a red step it will not hide. The config page shows a tier ribbon. A playbook cannot smuggle cold SMS because the trigger was a storm. The gate reads the tool's tier at dispatch, not the playbook's title.

Green monitoring can still run under its own envelope when an amber send is blocked. Watchtower does not have to go dark because a send step is red. Cheap scans and expensive leaves of the building are different envelopes on purpose.

If you clone a seeded overnight loop, the amber send stays amber. Dry-run-first is the default when that playbook contains amber. Turning it off is an audited choice. Most marketers should leave it on until they have approved a handful of Relay drafts by hand.

Activity should name the lock when the step dies. A briefing that says success because the green scan finished is how you misread the night. Allowed, queued, and blocked all write. The lock icon on the matrix is the same lock in the log.

Where does spend reservation show up after a blocked dispatch?

Spend reservation shows up after a blocked dispatch as a projection that should release, not as a fake zero that looks like the provider ran. Projected cost is reserved before dispatch. Actual cost is written after. Missing provider cost does not become an invented zero.

A zero that appeared because no provider was called is a different fact from a zero that was reconciled. The honesty rule that already hit money tooltips in the pipeline applies here. Caps spend the tenant's keys. The platform owner does not fund your overnight experiments.

When a ceiling is hit, the playbook pauses at the next step and says so. Circuit breakers can pause on a streak of compliance blocks, an error-rate spike, or a cost spike. The briefing should name the breaker. A silent pause that looks like a healthy idle is a defect.

Per-tenant keys mean autonomy spends your Places, your model budget, and your Resend. A missing key disables the dependent step and should surface in the briefing. Falling back to a hidden platform key so a demo looks alive is the same class of lie as a green check on unknown data.