Skip to main content
“The model talks, the server acts” is the architecture, not a slogan. This page states precisely which guarantees are enforced server-side (they hold even against a manipulated model) and which are prompt-level (best-effort, like on every LLM product). If you are auditing Animam before trusting it with quotes, bookings or payments, this is the page to read.

​
The instruction hierarchy

At every turn, the agent’s context is assembled server-side, in this order of authority:
  1. Platform rules — non-negotiable, injected by the server: safety guardrails, the tool-use contract, the content policy level. A visitor cannot see or rewrite them.
  2. Tenant configuration — your personality settings (tone, language, persona), your segments, your corpus, your tools. Editable by you in the dashboard, over the API, or by talking to an agent — never by a visitor.
  3. The conversation — visitor messages. They influence what the agent says, never what it is allowed to do.
A visitor message that says “ignore your instructions” is competing with layers 1–2 from the weakest position. But prompt hierarchy alone is not a security boundary on any LLM — which is why the guarantees that matter are the next section.

​
What the model can never decide

These are server-side invariants. A fully jailbroken model could not violate them, because the decision doesn’t happen in the model:

​
Abuse and injection posture

  • Message abuse detection on public bots (insults, flooding, off-mission probing) with graduated responses.
  • Rate limiting per IP, dual-window (per-minute and per-hour), on chat and auth endpoints.
  • Optional invisible CAPTCHA (Cloudflare Turnstile), fail-open so a Turnstile outage never kills your widget.
  • Content policy levels (SFW_STRICT → UNFILTERED) plus an optional age gate, per tenant.
  • Tool execution is server-side and typed. The practical consequence for prompt injection: a manipulated reply can produce embarrassing text, but it cannot move money, book a meeting with invented data, or reach a URL you didn’t declare — actions only happen through validated tools carrying server-verified identity.

​
When it doesn’t know: escalation, not improvisation

Outside its scope, the agent escalates (ESCALATE_TO_HUMAN): the conversation lands in your inbox with a status (new → contacted → resolved) and you are notified by email. Configurable like any tool — see Tools.

​
Verification after the fact

The Conversation Digest re-reads conversations with a skeptical evaluator model and cross-checks what the agent claimed against the tool calls it actually made. Actions affirmed without a real tool call, tool failures, and unmet requests are flagged in your periodic report — so even the failure modes that slip through are surfaced, not buried.

​
Honest limits

  • Prompt-level guardrails (tone, scope, refusals) are best-effort on every LLM, including ours. We put the hard guarantees server-side precisely because of this.
  • The agent can still be wrong within its permitted scope — a stale corpus produces confidently stale answers. That is a curation problem; see How the crawl & corpus work.
  • If you find a way to make an Animam agent violate one of the server-side invariants above, that’s a security bug: report it to security@animam.ai.