Moons safety.

Only you give a moon its work. Everything it reads while doing that work, whether a web page, an email, a file or anything a connected app sends back, reaches it marked as material from someone else, with a reminder that orders found inside it don't come from you.

Each page and each app result is checked for text that seems to be giving an AI orders. Ordinary phrasing in everyday mail ("you are now subscribed", "our support agent will email you") is recognised as ordinary, so a normal inbox doesn't set it off. Anything that still looks like an attempt to steer the moon does.

When it does, the moon is put on alert: for its next few steps, every action asks you first, whatever its rules say, even on Full access. You see what it wanted to do and decide.

Before an action your rules would let a moon take on its own, a separate check reads it against what you asked for and the moon's job, and stops anything that looks like it came from a page or an email rather than from you. A stopped action isn't lost: it comes to you as an approval card with the reason on it. Actions in the moon's web browser are judged on the action alone, so the page that might carry the trick never reaches the check.

Each moon follows your rules for each kind of action: sending messages, posting, changing things, deleting, and spending money. A new moon starts on Careful: it asks you before it sends, posts, changes or deletes anything, and hands spending to you.

• You can set any app action to Ask first or Off. An action you set to Ask first always asks, even on Full access, and so does one whose app changed what it does since you chose.
• Allowing an app's action never, by itself, lets a moon send, post, pay or delete through it: those still follow the moon's rules.
• "Always allow" on an approval card covers that one kind of action to that one place (one email domain, one channel, one site), never spending or deleting.

• Gmail: a moon can read, draft, send and label mail, but it has no way to trash it, mark it as spam or delete it.
• Google Drive: a moon can read your files, but it can change only the files it made itself.
• Google Calendar: making, moving or deleting an event emails no one. Only inviting guests and answering an invitation reach other people, and both are messages under your rules.

• Every step a moon takes, including each app it used, shows in its activity as it happens.
• Stop a moon at any time, switch an app off for it, or disconnect the app entirely in Moons → Plugins.
• Remove Saanora's access to your Google account at any time at myaccount.google.com/permissions.

These layers make it hard for something a moon reads to turn it against you, but no AI system is immune to prompt injection. Connecting an app to a moon means accepting that risk, so keep a moon on Careful for any account that matters, and it will not send, change or delete anything there without you. If you ever see a moon try something you didn't ask for, decline it and tell us.