Employee Passport
Role, version, owner, tested capabilities, limitations and dependencies.
Trust is part of the job description
Useful autonomy.
Visible authority.
ATACSYS makes an AI employee’s duties, evidence, access and approval boundary inspectable before it starts. Important actions stay with an authorized person.
Versioned passportMinimum accessHuman approvalPause and recovery
01 / Four controls
Know what can happen before it happens.
ATACSYS does not rely on a broad promise that an agent is “safe.” The operating boundary is defined in four separate layers and tied to the exact employee version.
Minimum permissions
Only the tools and data needed for the agreed task are requested.
Provenance log
Important facts, actions, approvals and versions remain traceable.
Pause and rollback
Execution can stop while the latest safe checkpoint remains available.
02 / Human authority
Preparation can be automatic. Accountability cannot.
The initial workforce is designed for low-risk digital operations. Actions that create legal, financial, reputational or access consequences require a human decision.
| Work | Employee may prepare | Human must approve |
|---|---|---|
| Communication | Classify, summarize and draft | External publishing or commitments |
| Money | Calculate, compare and flag | Payment, transfer, refund or price change |
| Systems | Read permitted records and suggest updates | Access changes, deletion or production changes |
| Professional judgment | Organize evidence and prepare a brief | Legal, medical, investment or final HR decisions |
03 / Verification
A badge is not enough.
Verification belongs to a specific version, task and boundary. A material change to the model, instructions, tools or permissions creates a new review requirement.
Inspect
Review dependencies, licences, requested access, data flow and declared limitations.
Test
Run representative scenarios, edge cases and adversarial inputs in a controlled environment.
Publish
Issue a versioned passport with evidence, cost profile and required approvals.
Monitor
Track accepted work, corrections, incidents and changes that invalidate prior evidence.
Company data boundary
Memory is separated from the worker.
The creator does not receive direct access to customer memory. ATACSYS transfers only the approved context required for the role, through controlled infrastructure and temporary permissions.
Customer controls
Source data, approved instructions, decisions, work results, retention and deletion requests.
Employee receives
A limited working context for the current role—not an unrestricted copy of the company.
Creator retains
Agent code and general product IP, subject to its licence and the ATACSYS provider agreement.
See the boundary in practice
Test a small task before granting a real role.
The supervised pilot uses an agreed low-risk workflow. You review the output, log, access request and first memory checkpoint before deciding what comes next.