Guardrails

fOS takes real actions — it makes offers, confirms wins, and bills commission. That makes its guardrails as important as its capabilities. This page is the single home for how fOS stays safe and trustworthy while operating.

Confirmation before money moves

Actions that move money or commit the carrier do not fire silently. When fOS is about to take such an action — most importantly confirm-win, which bills commission — it returns a "confirmation required" result and pauses for explicit approval before proceeding. The human (or the calling surface) sees exactly what will happen and must approve it. Read-only lookups never require this; state-changing actions do.

Idempotency on the money path

Even after approval, network retries and double-submits happen. Money-moving actions are idempotent: confirming the same win twice — whether from a retry, a refresh, or a concurrent call — produces a single invoice, never two. The confirm-win path in particular is keyed so that a repeat is recognized and returns the original result rather than billing again. This is what makes it safe for an autonomous operator to drive.

Clarify, don't guess

An under-specified request is a trap: "find me loads" without a where or a when would run a blind, useless query. fOS has a qualification floor — before running a query it checks that it has the minimum it needs, and if not, it asks for the missing detail rather than guessing. When it does make a reasonable assumption (for example, "pickups from today, within 100 km of the named city"), it discloses that assumption in the result. And when something genuinely fails — a location it cannot geocode — it says so honestly instead of returning a plausible wrong answer.

Never reveal the floor

The bid recommendation is built on a cost-derived walk-away floor — the least the carrier should accept. In negotiation, fOS checks a counter-offer against that floor but never reveals the floor itself to the counterparty. It negotiates down toward the floor from a higher ask and hands off to a human when a deal would require going below it or gets complex. The carrier sells capacity; fOS never undercuts the carrier's own position.

Org-scoped access

Every fOS action is scoped to an org (tenant). A user acting through fOS only ever sees and touches their org's freight, fleet, and settings. On external surfaces where a user may belong to several orgs, fOS establishes which org is in context before it operates, and all reads and writes respect that scope.

Scoped exposure on external surfaces

Not every tool is available everywhere. On external assistants (via MCP), fOS exposes read tools broadly but gates write tools behind permission and phasing, and some sensitive actions are not exposed externally at all. The web app has the fullest tool set; a live voice call has a tight negotiation-focused set. What each surface can do is covered in Surfaces.