| Read-only versus change-making commands | 1 | Reads run freely. Every write goes through Approvals. |
| Context before action | 2 | Discovery runs one background investigation when a connection first reaches Connected, and cites the read behind each fact. Results fill the Discovery section of the connection’s detail panel. |
| Structured memory | 2 | Incident memory records symptom, cause, and fix. Admins can edit or delete any memory item. |
| Skills and tool risk | 3 | A skill is a SKILL.md file. Risk is decided at the call by the always-blocked list, then Rules, then the Approval mode. |
| Protocol layer | 3 | Your own MCP server becomes a connection, with its tools sorted into reads and writes. |
| Two engines: sense, then resolve | 4 | Pulse suppresses noise and clusters alerts. Investigations run only on incidents. |
| Sensitive data kept from models | 5 | Guardrails show agents a placeholder instead of secrets, emails, card numbers, and your own ID patterns. |
| Sandboxed execution | 5 | Commands run in an isolated, CloudThinker-managed sandbox. Shell commands on a Worker run on your machine (see the warning below). See the security overview. |
| Policy as code | 6 | Export active Rules on the Rules page downloads Rules, approver groups, and Approval modes as YAML. |
| Autonomy levels | 6 | Two Approval modes: Manual (a person approves every write) or Auto (Rules first, optional AI judgment, then ask a person or refuse). |
| Evaluation | 7 | There’s no built-in golden-set replay harness. Run your evaluation outside the product with the Appendix A method. |
| Observing the agents | 8 | Tool calls and Show reasoning in each conversation. Agent actions in Admin Settings → Audit Logs. Spend in Admin Settings → Usage. |
| Day 2 budgets | 9 | Credit limits set a monthly budget per workspace, with Throttle or Notify only. |
| Kill switch | 6 | No single halt-all switch. The control that works today is Allow writes: turn it off on a connection and every change on that connection is refused. Setting each run type to Manual sends its writes to a person, but that alone isn’t a halt, because a chat can pick its own mode in the composer. Turn off On duty in Resolve to stop automatic investigations, and switch off an automation’s triggers to stop its runs. Once CloudThinker turns on Rule enforcement for your workspace, Rules add a broader halt. A Deny Rule for every operation, on every connection, with Never allow break-glass on, refuses every agent write in every mode while reads keep running. |
| Standing missions | 12 | Automations, with limits for unattended work set under autonomous agents. |
| Model calls on your own account | | BYOK lets you bring your own LLM credentials. |
| Data residency | | Deployment options: Workers today, plus dedicated and self-hosted deployments through an early-access program. |
