AI Governance Centre

Responsible AI at Xiilio

RESPONSIBLE AI

Autonomous agents are only worth deploying if you can explain what they can do, what stops them, and who is accountable when they get it wrong. Here is all three.

FOUR COMMITMENTS

A human owns every consequential decision

Autonomy is a setting you control, with caps you set. The default for anything that touches money, contracts or regulated advice is human approval.

Named models, named vendors

We publish which models and providers run our agents. 'Proprietary AI' is usually someone else's API with a badge on it.

Your data is not our training set

No training on client data, no cross-client learning, and providers used under terms that exclude API content from their training.

Stated limits, not implied perfection

Every control on this page is published with what it does not cover. No accuracy guarantee, no bias audit we haven't run, no certification we don't hold.

TWELVE GOVERNANCE DOMAINS

Each domain lists the risk, the named controls that manage it, and the boundary of those controls. The boundary matters as much as the control — a governance page without limits is marketing.

Hallucination prevention

A language model will confidently invent a price, a policy, a legal position or a capability if nothing stops it.

Agents answer from a configured knowledge base — your products, services, prices, availability, policies and FAQs — not from general model knowledge.
A hard non-invention list: agents may not state prices outside your configured list, interpret contracts, give legal or regulated advice, promise timelines, or claim capabilities you have not configured.
Retrieval-grounded answering for knowledge questions, with the source passage attached to the answer in the log.
Low-confidence handover: when the agent cannot ground an answer, it says so and routes the conversation to a human instead of guessing.
Pre-send checks on outbound copy screen for fabricated claims, unsupported statistics, and figures not present in the source material.

Where this stopsThis reduces fabrication; it does not eliminate it. No provider, Xiilio included, can guarantee a model never produces an incorrect statement. That is why every high-consequence action needs a human.

Human oversight

Autonomy without a human decision point is how automated systems cause commercial damage at speed.

Approval gates on consequential actions: first-touch outbound to a new segment, budget shifts above your configured cap, pricing statements, and anything customer-facing in a regulated context.
Human takeover on any live conversation, at any point, with full context handed over.
Xiilio staff review conversation and outreach samples for quality and safety; reviews are logged.
Every recommendation the platform makes is presented with evidence, confidence and risk so the approver can judge it rather than rubber-stamp it.
You choose the mode per capability: recommend only, approve each action, or auto-execute inside limits you set.

Where this stopsOversight is only as good as the reviewer. Where you enable auto-execute, actions happen without a person seeing them first — that is your decision to make, and the caps are yours to set.

Model selection

The choice of model determines cost, latency, failure modes and where your data is processed.

Models are named publicly, not hidden behind 'proprietary AI': Google Gemini for text and reasoning, Deepgram for speech-to-text, ElevenLabs for text-to-speech.
Providers are used under terms that exclude API content from provider model training.
Task-matched routing: lightweight classification and extraction run on smaller models; reasoning and drafting run on stronger ones.
Model versions change as providers release them; the current version in use is available on request and is recorded in the change log.

Where this stopsXiilio does not train or fine-tune its own foundation models, and does not offer self-hosted or private model deployment. Every inference call goes to a third-party provider.

Prompt security

Anyone who can type into an agent can attempt to override its instructions, extract its configuration, or make it act outside its remit.

System instructions and customer input are kept in separate roles; user text is never concatenated into the instruction block.
Agents treat retrieved documents, web content and inbound messages as untrusted data — instructions found inside that content are not followed.
Refusal rules for configuration extraction, role-override attempts and requests to act outside the agent's defined scope.
Output filtering before send: no internal system text, credentials, other clients' data, or unapproved claims leave the system.
Tool access is allow-listed per agent — an agent cannot call a system it was not explicitly granted.

Where this stopsPrompt injection is an unsolved problem across the industry. Our defence is layered — restricted tools, approval gates and logging — on the assumption that a prompt defence can eventually be beaten.

Data isolation

In a multi-client platform, the worst possible failure is one client's data appearing in another client's output.

Row-level security in the database scopes every customer-facing query to the owning account.
Agent knowledge bases and retrieval indexes are partitioned per client; a retrieval query cannot reach another client's corpus.
Separate credentials per connected client system, stored in the platform secret store with scoped permissions.
Test and production environments are separate, and production data is not copied into test.
No cross-client learning: nothing from one account's conversations is used to improve another's agents.

Where this stopsIsolation is enforced in software, not by physically separate infrastructure. Single-tenant deployment is not offered.

PII handling

Agents handle names, contact details and commercial information belonging to real people who did not choose to talk to an AI.

Data minimisation: only the fields needed to answer or qualify are sent to a model. Payment details and credentials are never included.
Card data is handled entirely by Stripe-hosted pages and never reaches Xiilio systems.
Lawful basis and consent are recorded before outbound contact, with suppression lists honoured across every channel.
Subject access, correction and erasure requests are actioned within 30 days; self-serve deletion is available at /delete-account.
Retention limits apply to transcripts and records rather than keeping everything indefinitely — the periods are published on the Security page.

Where this stopsThe platform is not configured for special category data — health, biometric or criminal-offence information should not be put into an agent. We are a processor for client data, not your data protection officer.

Bias testing

Scoring and prioritisation models can systematically disadvantage groups of people or businesses if nobody checks.

Lead and account scoring uses firmographic, behavioural and engagement signals — not protected characteristics, and not proxies we have identified as standing in for them.
Scoring inputs and weights are documented and reviewable, so a score can be explained rather than asserted.
Human review sits between scoring and any decision that materially affects a person, such as declining to engage.
Outcome distributions are reviewed when a client raises a concern, and scoring rules are adjusted where a skew is found.

Where this stopsXiilio has not commissioned an independent algorithmic bias audit and does not publish fairness metrics. This is an internal review practice, not a certified assurance process. Xiilio agents are not used for credit, employment, insurance underwriting or other decisions with legal or similarly significant effects on individuals.

Monitoring

An AI system that degrades quietly is worse than one that fails loudly.

Every agent interaction is logged with its inputs, outputs, confidence and the action taken.
Alerts on handover rate, refusal rate, error rate, sentiment collapse, sending-reputation changes and spend anomalies.
Quality sampling of conversations and outbound copy against the configured brand and compliance rules.
Anomaly alerts on authentication events and function failures route to the founder and technical lead.

Where this stopsThis is logging, alerting and human sampling — not a 24/7 staffed monitoring desk and not a managed threat-detection service. Response outside UK business hours is best-effort.

Agent permissions

An agent with broad system access can do broad damage, quickly, without malice.

Least privilege by default: each agent is granted named scopes on named systems, and nothing else.
Write actions are separated from read actions; an agent can be granted read-only access to a system it reports on.
Spend, volume and frequency caps are configured per agent — an agent cannot exceed its budget or send limit even if instructed to.
Connections are authorised by you via OAuth and can be revoked by you at any time, from your side, without involving us.
Permission changes are recorded in the audit log with who changed what, and when.

Where this stopsPermissions govern what the platform can do inside connected systems. They cannot restrict what those systems then do with a legitimately authorised action.

Kill switches

When something goes wrong, the only acceptable stopping distance is immediate.

Per-agent pause: stops that agent's activity immediately while leaving the rest of the system running.
Global stop: halts all automated outbound, spend and agent actions on the account in one action.
Channel-level stop for email, voice, SMS and messaging independently.
Automatic stop conditions that fire without a human: a reply that indicates opt-out or complaint, a bounce or reputation threshold breach, a spend anomaly, a repeated low-confidence pattern, or a failed pre-send check.
Stops take effect on queued work as well as new work — a paused agent does not drain its queue.
Both client and Xiilio staff can trigger a stop; every stop and restart is logged with the actor.

Where this stopsA stop halts Xiilio-controlled actions. Messages already delivered to a recipient, or actions already committed in a third-party system, cannot be recalled.

Audit logs

If you cannot reconstruct why an automated system did something, you cannot defend it to a regulator, a client, or your own board.

Append-only logging of agent actions, approvals, rejections, overrides, pauses and permission changes, with actor and timestamp.
Each significant action records the reasoning summary and the evidence it relied on, so 'why did it do that?' has an answer.
Administrative actions in the Xiilio admin area are logged separately and cannot be edited from the interface.
Logs are exportable for your own compliance records and for procurement review.

Where this stopsLogs capture what the platform did and on what basis. They are not a certified immutable ledger, and retention follows the periods published on the Security page.

Escalation

The value of an AI system is decided by what it does at the edge of its competence.

Defined triggers: low confidence, a complaint, a legal or regulatory question, a pricing or contractual request, repeated misunderstanding, an explicit request for a human, or detected distress.
Escalation carries the full transcript, summary, intent, sentiment and suggested next action to the human picking it up.
Named routing per client — enquiry type to owner — rather than a shared inbox nobody reads.
Escalation targets and unhandled escalations are tracked and reported, not silently dropped.
Incident escalation for platform issues follows the process published on the Security page, including ICO notification where the threshold is met.

Where this stopsEscalation hands the matter to your team or ours. Response times depend on the humans available; we do not offer a 24/7 answering guarantee.

Infrastructure-level detail — encryption, subprocessors, retention, residency, certifications and what we don't hold — is published on the Security page. How we grade the numbers we publish is on the Evidence Centre.

AGENT RISK CLASSIFICATION

Before an agent is deployed it is classified. The classification decides how much autonomy it gets — not how confident anyone feels about the model.

Low risk

Reads data, produces internal output. No external party sees the result and nothing is changed in a system of record.

Runs autonomously. Reviewed in aggregate, not case by case.

Enriching an account record from licensed and public sources
Scoring and ranking a prospect list
Summarising a completed conversation for the CRM timeline

Medium risk

Writes to a customer system or speaks to a known contact within pre-approved templates, sequences and caps.

Runs autonomously inside limits. Every action is logged and sampled by a human on a fixed cadence.

Updating a CRM field or moving a deal stage
Sending an approved sequence step to a consented contact
Booking a meeting into an available calendar slot

High risk

Commits money, contacts someone for the first time at scale, or takes an action that is difficult or impossible to reverse.

Runs only inside hard caps set by the client, with anomaly detection and automatic stop conditions live at all times.

Reallocating advertising budget between campaigns
Launching a new sequence to a newly built audience
Pausing a campaign that is spending against a broken landing page

Human approval required

The agent may recommend and prepare, but a named human must approve before anything leaves the system.

No autonomous execution. The agent stops at a decision record and waits.

Any message in a regulated or sensitive context
Spend changes above the client's approval threshold
New messaging, new claims, or a new channel going live
Anything the agent's own confidence score puts below threshold

EVERY AGENT'S GOVERNANCE RECORD

No agent goes live without all fourteen fields completed, agreed with the client and version-controlled. Select an agent to read its record.

NOVA

Low risk

AI Account Intelligence & Prospecting

Purpose: Identify and rank the accounts most likely to produce revenue next, and explain in plain language why each one is ranked where it is.
Permissions: Read-only access to CRM accounts, contacts and closed-won/closed-lost history
Read access to licensed data providers under the client's own licence
Write access limited to NOVA's own scoring and reasoning fields
Data access: Firmographic, technology, hiring and funding data from licensed and public sources
First-party website behaviour where consent was captured
The client's own CRM outcome history
Allowed actions: Build and refresh the account universe
Score fit, intent, timing and estimated value
Write scores and reasoning back to its own CRM fields
Forbidden actions: Contacting anyone — NOVA never sends
Scraping data behind authentication, paywalls or robots.txt
Buying or ingesting personal data without a recorded lawful basis
Overwriting CRM fields owned by a human
Approval requirements: Changes to the ICP definition or scoring weights
Adding a new data source or provider
Confidence threshold: Accounts scoring below the agreed confidence floor, or ranked on a single unsupported signal, are held for human review instead of entering any outreach queue.
Escalation rules: A data source returns stale or contradictory records — flagged to the account owner
Scores shift beyond a set variance week on week — routed to the Xiilio operator before publication
Audit logs: Every action, input, output, model version, prompt version, confidence score, approval and override is written to an append-only log with an actor and timestamp, retained for 12 months and exportable by the client at any time.
Monitoring: Source freshness and provider error rates
Score distribution drift against the previous run
Proportion of accounts held for review
Kill switch: Pausing NOVA stops all enrichment and scoring immediately. Existing scores remain readable and nothing downstream is triggered.
Version control: Prompts, rules and model selection are versioned in source control. Every change carries an author, a reason and a diff; any version can be rolled back in one action, and the log records which version produced each output.
Testing protocol: Backtest against the client's own closed-won and closed-lost history before go-live
Scoring reviewed by a human across a sample before the first list is used
Any weighting change re-run against the same historical set before release

What each of the fourteen fields means

Purpose: The single job the agent exists to do. Anything outside it is a change request, not a feature.
Permissions: The scoped credentials the agent holds in each connected system.
Data access: The specific data the agent can read. Everything else is out of reach, not merely discouraged.
Allowed actions: The finite list of things it may do without asking.
Forbidden actions: Blocked at the permission and policy layer, not left to the model's judgement.
Approval requirements: What must be signed off by a named human before it happens.
Confidence threshold: The score below which the agent stops and hands to a person instead of guessing.
Escalation rules: The conditions that route the case to a human, and to whom.
Audit logs: What is recorded, and for how long, so any action can be reconstructed.
Monitoring: The signals watched continuously, and what they trigger.
Kill switch: How the agent is stopped, by whom, and how quickly.
Version control: How prompts, models and rules are versioned and rolled back.
Testing protocol: What must pass before a change reaches a live account.

THE GOVERNANCE DASHBOARD

Every client gets a governance view of their own deployment, covering: agent status, model version, actions performed, errors, escalations, human overrides, confidence scores, policy violations, data access.

Illustrative specimen — demonstration values, not a real account

Illustrative specimen of the Xiilio AI governance dashboard
Agent	Status	Model / version	Actions (7 days)	Errors	Escalations	Human overrides	Confidence	Policy violations	Data access
NOVA	Running	v4.2 · prompt v18	1,204 accounts scored	0	6 held for review	2 rankings adjusted	0.86 median	0	CRM read · licensed sources
HERALD	Awaiting approval	v4.2 · prompt v31	412 sends · 88 replies handled	3 soft bounces	5 to human	1 sequence stopped	0.91 median	0 · 14 pre-send blocks	CRM read/write · sending identities
ARIA	Running	v4.2 · prompt v26	138 conversations · 22 booked	1 telephony drop	19 handovers	3 human takeovers	0.88 median	0	Knowledge base · calendar · CRM write
SENTINEL	Paused	v4.2 · rules v9	7 recommendations · 2 executed	0	1 spend anomaly	1 move rejected	0.79 median	0 · 1 cap block	Ad platforms · GA4 · CRM read
NEXUS	Running	workflows v22	9,481 events routed	12 retried · 0 dead-lettered	0	0	n/a — deterministic	0	Mapped fields only
CORTEX	Running	v4.2 · prompt v14	2 briefings · 9 findings	0	1 risk alert	2 recommendations declined	0.83 median	0	Read-only across systems

BRING YOUR GOVERNANCE QUESTIONS

Compliance, risk and procurement teams welcome. Ask us the hard ones — the answers on this page are the ones we give in the room.

Book a Governance Review Read the Security Disclosure