Controls.

Datura agents are built to operate under attack. Every integration is allowlisted, version-pinned, and schema-validated at the boundary, and every response is treated as untrusted input — hardening against supply-chain compromise and skill injection is an architectural property, not a configuration option. Agent capabilities ship in immutable manifests with least-privilege tool access, so an agent cannot quietly acquire abilities it was not sold with.

High-impact actions route through human approval by construction — runaway autonomy is contained by the runtime, not by policy documents. Circuit breakers, kill switches, and state rollback are part of that runtime. The live marketplace runs this way today: no auto-send — outreach output is print-ready and a human mails it; dry-run is the default; every mutation is receipted.

Every run leaves a receipt, and every action an agent takes is reconstructible from its logs after the fact. A deliverable you cannot audit is a promise; the receipt is what makes it a proof. This is the same standard the site holds itself to — the operating counters behind every listing come straight from those receipts, including the zeros.

Custody is a ladder, and the rung is chosen per engagement. The standard engagement runs as a managed service: your written criteria in, receipted deliverables out. Above that sits bring-your-own-key operation with zero-data-retention model access — the keys, and therefore the exhaust, are yours. The top rung is sovereign: the pipeline installed on hardware you control, in open formats you can read without us — the way the firm already runs its own systems. Which rung an engagement runs on is fixed in writing at scoping, before anything starts.

Questions from counsel are welcome: [email protected]. To see the posture in a deliverable, start with the live marketplace or a free SpotMark run.