Off by default. An agent can only call actions you switched on; everything else is never offered to it. Write actions stay off until you turn them on one by one.
Checked twice. An action that isn't allowed is never shown to the model, and every call is checked again at the moment it runs. A blocked call is shown in the chat and in the conversation's steps.
Acts as the user. Calls carry the user's own sign-in, so your API decides what they may do.
Visitors can't make changes. Someone who isn't signed in can read, but not change data.
Allowed origins. The widget only connects from the exact origins you list.
No shell, no files. The agent has no built-in tools at all. The only things it can do are the actions you connect.
Page context is data. Anything your page passes as context is labelled as untrusted in the agent's instructions, and capped in size.
Secrets stay server-side. Public keys are safe in the browser; FRANKIE_JWT_SECRET and API credentials never leave your server or Frankie.
Team roles. Members can manage agents and actions; changing where data is sent, credentials, secrets and deletion need an owner or admin.
Honest failures. If an action fails, the agent says so instead of claiming success.