There’s a tempting shortcut when you add AI to an operational system: give the model a database connection and a pile of HTTP endpoints and let it figure things out. It’s fast to demo and impossible to govern. The moment an agent can write anything, you’ve lost the guarantees that made the system trustworthy.
Aerandil takes the opposite stance. An agent gets exactly the same surface as a human operator or a partner integration: typed actions, each one permissioned, validated, idempotent, and recorded as an event.
Tools are ontology operations
Every registered action is exposed as a typed Model Context Protocol tool. When a model calls one, it goes through the same validators and the same permission checks as a request from the front desk. There is no faster, less-governed path reserved for AI — because a less-governed path is exactly what you don’t want a probabilistic system to have.
Why this matters
- Auditability. Every action an agent takes is an event with explicit lineage. You can answer “why did this change?” months later.
- Containment. An agent can’t do anything an action doesn’t already permit. The blast radius is the contract, not the database.
- Parity. The same tools work for staff, software, and models — so improving the contract improves every participant at once.
Intelligence becomes a participant in the operation, not an exception to it. That is the only version of “AI-native” we think is worth shipping.