Autopilot / Safety & guardrails
Safety & guardrails
Autopilot creates a risk that a flow builder does not: content nobody has read reaching a real user. Most of the product is machinery for making that survivable, and this page is all of it in order.
Before it is written
The plan only selects archetypes whose required facts are present, and only day-one-safe ones until your account has been measured. Your brand voice and forbidden claims are part of the brief, not a post-hoc filter.
Before you see it
Every generated screen is rendered headlessly — the same layout engine that runs on the phone — across devices and languages. Overflow, clipping, contrast failures and off-vocabulary wording are caught and repaired in a bounded number of rounds. What could not be repaired is not shown as fixed.
Before it reaches a user
The approval gate. Nothing autopilot has written is served until you press the button, and the locks you set there become schema constraints rather than instructions.
As it reaches users
A canary ramp rather than a switch. Guardrail metrics — including crash rate and diagnostics regressions — are watched throughout, and a breach rolls the change back without asking.
After it is live
Every autonomous action is in the audit log with its reason, and summarised in the weekly growth memo. A rewritten flow enters as an experiment arm against the one it wants to replace, so nothing is swapped out on a hunch.
Whenever you want
The kill switch. One per account, and it stops all autopilot publishing at once.
Locks are structural, not instructions
The difference matters more than it sounds. A tool that tells its model “never change the price display” is relying on the model obeying. Uplift Funnel represents what the optimizer may touch in the schema itself: a field that is not marked optimizable cannot appear in a patch, so a violating change is not something that gets caught in review — it is something that cannot be written down.
Absolute locks apply on top of that: your price display and required legal text are never editable by autopilot at any autonomy level, and the screens you freeze at the approval gate are added to the same list.
Serving is never interrupted
Your app is out of scope
Autopilot changes Uplift flows and nothing else. It has no access to your app's own screens, and the sensitive operations a flow can request — a purchase, a sign-in, a permission prompt, a photo picker — are handlers you implement. The flow decides when to ask. Your code decides what happens, and can refuse.
The same applies to presentation: your presenter can return false at any moment and nothing is shown. The frequency cap is not spent on a screen nobody saw, so the flow can be offered again later.
What autopilot spends
Generation costs real money to run, so autopilot meters its own production budget. When an account reaches its ceiling, new writing stops, running experiments carry on, and the growth memo says why. You are not asked to manage credits — the ceiling is a safety mechanism, not a product surface.