The problem with 'ask before you send'
Most AI agents put the approval prompt in the user interface. The model writes an email, a confirmation dialog appears, you click yes, and the email goes out. It looks like consent. But the check lives in JavaScript — the same code the model can, in principle, ask the platform to change on the next release. If the confirmation is a soft rule, one prompt-injection or one policy tweak can move it.
What Nova does instead
Nova has one core loop: catch, draft, approve, execute. The approval isn't a JavaScript flag. It's a row written to an append-only table called `card_events` when you tap approve. Before any external send — an email, a WhatsApp reply, a calendar invite — the database refuses to accept the change unless a matching approval row already exists for that exact card.
In practice this means the send trigger looks at three things: is there an authenticated user, does the card belong to them, is there an approval event for this card's current payload? If any one is missing, the row can't move to `sent`. Not softly — the transaction fails.
Why that matters
- A bug in the model can't send an email — no approval row exists yet.
- A prompt-injection embedded in an incoming email can't jailbreak Nova into acting — the injection can only change the draft, and the draft still needs your tap.
- A future feature we ship can't quietly widen the auto-send surface — the invariant is in the schema, not in our code review discipline.
- You can audit it. Every approval leaves a permanent row. Every dismissal leaves a row. Every edit before approval leaves a row.
What auto-executes
Nothing that touches the outside world. Nova will auto-snooze cards you've told it to snooze, auto-dismiss reminders on your own schedule, and quietly fetch new signals from sources you already connected. Those are local state changes — they can't reach a customer, a bank, or a mailbox. Anything that could reach the outside — email, WhatsApp, calendar invite, invoice draft — waits for your explicit tap.
Why we think this becomes standard
The current wave of AI agents is optimising for autonomy. Booking flights. Drafting and sending. Chained tool use. That works for demos. It does not work for the hundred small trust decisions someone makes every week with their own life. By 2027, we think the interesting question in this category won't be 'how autonomous is your agent?' — it will be 'how visible and verifiable is its self-restraint?'
Nova is our attempt at a positive answer. Prepare everything. Send nothing. You approve.