# It does the thing, after telling you exactly what will happen.

> Growth and above. Nothing executes unconfirmed, and the confirmation states the consequence you didn't ask about.

Canonical: https://peeve.ai/product/do/

## How are credentials handled?

The model never sees a token and never picks an endpoint. It requests a capability by name, and an execution service maps that to the call, so a prompt injection can ask for a capability, never for an arbitrary request. Credentials live in the execution layer, out of the model's reach.

## What does the confirmation show?

The exact effect, including the consequence the user didn't ask about. Cancelling a plan states that three saved reports will be deleted and that the deletion isn't reversible. Nothing runs until the user confirms, and the primary action goes vermillion where it's destructive.

## Is every action logged?

Yes. Each Do action writes a signed audit entry and a transcript line: what was requested, what effect was confirmed, and when it ran. That record is what makes a backend action safe to offer through an agent as well as a cursor.


## More questions

### Can Peeve take backend actions like refunds or plan changes?

Yes, on Growth and above. Peeve executes the action on your backend after confirming the exact effect, marks destructive actions, and writes a signed audit entry. The model requests a capability by name and never holds credentials, so a prompt injection can ask for a capability but never compose a raw request.

### Can an AI agent take actions on a customer's account?

Yes, this is what separates an agent from a chatbot. On Peeve's Growth plan and above, it executes account actions on your backend after confirming the exact effect, including the consequence the customer did not ask about, and writes a signed audit entry. The model never holds credentials; it requests a capability by name.

### Can AI cancel or change a subscription for a customer?

Yes, when it can perform real write operations with a confirmation step. Peeve maps such an action to one of your own endpoints and runs it only after showing the exact effect, for example that cancelling deletes three saved reports, with the destructive option marked. Nothing runs until the user confirms.

### How do you keep an AI agent from doing something dangerous on the backend?

You constrain what it can do and confirm sensitive writes. Peeve is read-only until you grant capabilities one at a time in a reviewed config file, every write states its effect and is confirmed, actions run within a workspace allow-list, and one command is a kill switch that disables all acting at once.

### Does the AI agent log the actions it takes?

Yes, every action should be auditable. Peeve writes a signed audit entry and a transcript line for each backend action: what was requested, what effect was confirmed, and when it ran. That record is what makes an action safe to offer through both a human-facing cursor and an AI agent.