Anyone selling AI installs should be able to pass their own vetting. These are my answers to the same ten questions I tell every business owner to ask, and I invite you to ask me them again in person. Watch my face.
A note on honesty: this page describes how I actually build, not how I would like to build someday. If an answer changes, the page changes.
It's real and it can't be completely prevented, by anyone, including me. So I contain the blast radius instead of pretending to block it. My current build runs in its own isolated environment, a dedicated container or virtual machine, with read-only access to the accounting system, no email access, and no way to reach anything outside its own sandbox. A successful injection has almost nowhere to go.
In its own isolated environment, container or VM, not on the client's production machines, with read-only access to the one system it needs and nothing else. Access is granted per task, not admin by default.
The client's credentials stay the client's own, in the client's own environment file on their side. They are never pooled, never mine, and never hardcoded into tracked files.
The install backs up on a schedule to storage the agent itself cannot touch. And I don't just have backups. I have tested the restore: on July 13, 2026 I destroyed my own production agent's VM and rebuilt it from its backup, end to end. I was back up and running in 30 minutes.
I back up the entire VM, which is what makes the restore that fast. That test was on my own install — a client environment with more agents and more moving parts would take longer, and I’m not going to put a number on yours until I’ve tested it there. What I can tell you is that the backup exists, the agent cannot reach it, and the restore is one I’ve actually run rather than one I assume works.
This is the exact question that once cost me $300 in bitcoin to learn, so my own answer has to be airtight.
Every action the agent takes is logged — every file it touched, every message it sent, every call it made — and so is every human decision on top of it, including the ones where somebody said no. I can show you a client’s day action by action, and I can show you what got stopped. An approval log where nobody ever rejects anything isn’t oversight, and I won’t hand you one and call it that.
The client owns the machine and the accounts. I show the client how to deactivate the agent themselves. It is one action, and it does not require a call to me.
One client per install. No shared systems and no shared memory across clients. My privacy policy states this explicitly.
Configuration and skills live in git repositories, with secrets excluded from tracking. There is a history for every change and a way back from every mistake.
Yes. As of July 13, 2026 I carry technology errors and omissions coverage ($1M) and cyber liability ($1M), plus general liability and media liability coverage. And on the question that actually matters: I read the policy wording myself, looking for the generative-AI exclusion endorsement that carriers began attaching in 2026. There is none, on any of the three policies. A certificate of insurance is available the same day you ask.
The sequencing held, too. Nothing of mine ran in a client's production environment before this coverage was bound. Pilots stayed in an isolated sandbox until it was.
Production agents run on the client's own hardware or the client's own VPS, on the client's own account, never pooled on mine. Development and testing happen in a walled sandbox on my own server, clearly pre-production, and move to the client's machines before go-live. Model and provider are configuration settings, swappable when something better or cheaper ships.