03 · Do
It does the thing, after telling you exactly what will happen.
Growth and above. Nothing executes unconfirmed, and the confirmation states the consequence you didn't ask about.
Install Peeve ↗01How are credentials handled?
The model never sees a token and never picks an endpoint. It requests a capability by name, and an execution service maps that to the call, so a prompt injection can ask for a capability, never for an arbitrary request. Credentials live in the execution layer, out of the model's reach.
02What does the confirmation show?
The exact effect, including the consequence the user didn't ask about. Cancelling a plan states that three saved reports will be deleted and that the deletion isn't reversible. Nothing runs until the user confirms, and the primary action goes vermillion where it's destructive.
03Is every action logged?
Yes. Each Do action writes a signed audit entry and a transcript line: what was requested, what effect was confirmed, and when it ran. That record is what makes a backend action safe to offer through an agent as well as a cursor.
How a backend action stays safe
The model can ask for a capability. It can never hold the keys.
01
Requests by name
The model asks for a capability (cancel_subscription), never a URL, never a token, never a raw request it composed itself.
02
Confirms the effect
The user sees the exact consequence first, including the part they didn't ask about: “your three saved reports will be deleted.”
03
Executes on your service
An execution service maps the capability to your endpoint and makes the call with your credentials, which the model never sees.
04
Signs and logs it
Every action writes a signed audit entry and a transcript line: the record that makes a backend action safe to offer at all.
Why teams choose Peeve
The consequence, stated first
Every action confirms the exact effect (including the part you didn't ask about) before anything runs.
Credentials the model never sees
The model requests a capability by name; an execution service makes the call, so an injection can't compose an arbitrary request.
Signed and logged
Each Do writes a signed audit entry and a transcript line, safe to offer through a cursor or an agent.
14-day trial, no cardInstalls in an afternoonRead-only until you widen itKill switch in one commandCancel anytime, no lock-in