The brain
A sentence in. A view over real data out.
Auto is the agentic layer of Axiom. It never writes SQL, and that restriction is the entire security model.
Named for the autopilot in WALL·E, with the one revision that matters: this Auto never gets the wheel.
01The one-sentence model
The map is a picture of the catalog, and the catalog is the complete list of things Auto is allowed to look at.
If a node exists on the map, a real table backs it. If a table is not in the catalog, Auto cannot see it no matter what the command says. Widening what the system can reach means adding a catalog entry, never loosening validation.
02The hierarchy
Four levels, and only one of them holds data.
- CORE
Auto itself. Not a data node.
Every domain sends a few tendrils into it, which is what makes the field read as one organism rather than a handful of separate clusters.
- DOMAIN
An area of life.
Deliberately thin: an id, a label, a colour. It holds no data. Its only jobs are grouping and identity. This is the level you extend when you add an area of life.
- DATASET
A whitelisted view onto one real table.
The substantive level. It names the table, the exact columns that may be selected, a description written for the agent rather than for a schema browser, and a hard row ceiling.
- COLUMN
The exact fields exposed, and their types.
The type is what lets the validator reject a sum over a text column before the query ever reaches the database.
03The boundary
Why it is never allowed to write a query.
The server-side database client holds a service-role credential, so it bypasses row-level security entirely. In that setup a model that can emit SQL is a model that can read every table, including the ones holding broker tokens.
So the model does not emit SQL. It emits a spec: which dataset, which columns, what window, what aggregation. The select is built from the catalog's own column list, so a column that is not listed is never fetched, and a type mismatch is rejected before the database is touched.
Saved views store that spec rather than the rows it returned, which is why reopening one tomorrow answers the same question against tomorrow's data instead of showing a stale snapshot.
04The rules
Three rules it will not break.
Auto reads. It does not act.
No agent path writes the tables it reads. An agent may score a job posting and draft a tailored resume variant; it may not submit an application, send an email, or contact a human. Those are irreversible outward-facing acts taken in someone's name, and every drafted row lands at status draft until a person approves it.
There is no score column, and there will not be one.
A one-to-ten gut rating is an invented number. The honest fields on an idea are its kill criterion, meaning what would have to be false for this to be dead, and its cheapest test, meaning the smallest thing that would settle it. Both are falsifiable. A score never was.
The absent feature is the design.
The outreach agent audits a business and drafts an email. There is no send path anywhere in the codebase, and that is deliberate: not a disabled feature, an absent one. A test asserts that no mail library is imported in any agent path.
Every number on the surface is real. A reading with no honest denominator ships without a bar rather than with an invented one.
05The invitation
Build something
that runs without you.
Type it here — it lands on my dashboard and pages my phone.