Control and accountability

Sonata draws a hard line between reading and acting. An agent can read information and reason over it as much as the work requires. But any action that would change something outside Sonata, such as sending an email, creating a document, or modifying a connected system, pauses and waits for a person to approve that exact action before it runs. The classification is deliberately cautious: an action is treated as read-only only when the connected system affirmatively says so, and anything ambiguous is treated as a change that needs approval.

A workflow can be set to run with more or less human involvement. Even at its most autonomous, where it can move through review steps on its own, any action that changes a connected system still pauses for a person. There is no mode in which Sonata performs an unattended change on your behalf. When you approve an action, it runs once and only once.

Every step a workflow takes is recorded in order: what ran, what information it used, what it produced, when, and whether a person approved it or it proceeded automatically. Each run carries a frozen copy of the exact steps it executed, so the record reflects what actually ran even if the workflow is edited later, and a run’s history survives even if the workflow itself is deleted. This step history is designed as an immutable record you can review.

Changes to who has access and what role they hold are recorded at the database layer by the same mechanism that enforces the rules. These records are append-only: there is no path, in the interface or otherwise, for a user to alter or remove them, and they are written by the database itself whenever a change happens, including a change made directly in the database. The trail cannot be sidestepped by the application.

Your administrators decide what your organization’s agents can use: which AI models are available, which connections exist, and what those connections are allowed to reach, with a default that leans to read-only until access is deliberately granted. Nothing that expands what your agents can do or reach is enabled silently.