Every AI control in Oneop is on for everyone, and there is no switch to turn it off.
Prompt-injection blocking and PII redaction run on every model call, in every workspace, on every plan — including the free one. Run limits are published numbers, not internal policy. Every call passes one metered choke point, and at your cap you get a refusal rather than an invoice.
No credit card. Free plan, 2 seats.
- Prompt-injection checkBlocks the call outright on detectionAlways on
- PII redactionStrips identifying material before the prompt leavesAlways on
- Tool ceilings & thresholdsSeparate layer · Pro and above · off until you switch it onOff
- Credit reservationThe one metered choke point every call passesMetered
Within your cap — served by Gemini 2.5 Flash
At your cap — refused, HTTP 402. No overage invoice.
Guardrails: always on, every plan, no toggle
Two protections run on every AI call in Oneop and cannot be disabled by anyone — not by a plan, not by a setting, not by an administrator.
Prompt-injection blocking — unconditional. When the guardrail layer detects an injection pattern in the text heading for the model, the call is blocked outright and returns a refusal. This check runs before any provider call and is not part of the configurable guardrail layer. It applies to a chatbot turn from an anonymous website visitor exactly as it applies to an agent reading a ticket.
PII redaction — always applies. Personally identifying material is redacted from the prompt before it leaves the platform, and this happens even when the wider guardrail layer is not in use — a deliberate safe default rather than a paid upgrade.
The reason this matters: in most platforms, "AI safety controls" are an enterprise line item. Here they are the floor.
Configurable · Pro and above · shown off, its default
No plan, workspace or setting reaches this layer.
Autonomy is a permission, not a promise
No AI action in Oneop executes without an explicitly chosen autonomy level attached to the agent that proposed it.
The carve-out that survives all three: money and stock actions — posting a bill, issuing a purchase order, sending a payment reminder, placing a credit hold, or any task attached to an invoice, bill, sales order, purchase order or stock item — are fail-closed until they are switched on separately, regardless of autonomy level and regardless of a human approval. There is one dispatch choke point and the guard sits inside it.
- Suggest
- Logs the proposed action and notifies. Nothing is written.
- Approve
- Creates a durable approval record carrying the full payload, with a 48-hour expiry. The action executes only when a person accepts it.
- Autonomous
- Dispatches — through the same governed engine, not a faster side path.
Limits we publish
Oneop publishes the exact numbers that bound an AI agent run, because a limit you cannot see is not a control.
A run that hits any of them terminates as escalated and records which one — maximum iterations, budget exhausted, timeout, or no progress — with its full trace preserved up to that point. A person continues from there.
There is a fifth stop with no number attached: if two consecutive steps return identical observations, or the model emits unparseable output twice running, the run ends as no progress. That is what prevents an agent quietly burning a budget re-reading the same row.
| Ceiling | Value |
|---|---|
| Reasoning iterations | 6 by default · absolute hard cap 12 |
| Token budget | 6,000 per run |
| Wall clock | 45 seconds per run |
| Actions | 3 per run |
The property that matters isn't the size of the numbers — it's that they're enforced in the runner, not requested in a prompt, and they produce an honest stop instead of a confident guess.
Metering as a control, not a billing trick
Every LLM call in Oneop passes through one function, and that function reserves credits before the provider is contacted.
Usage is always recorded to a per-workspace ledger — that part has no flag. Approximately 110 distinct AI operation types across the product are metered, from a chatbot reply to a document OCR pass to an agent action, each at a published weight.
Cap enforcement is opt-in
Recording usage is unconditional. Refusing the call at the cap is a separate switch that is off until you ask for it. We would rather write that sentence than let you assume a wall you have not turned on.
And the invariant is defended by the build, not by memory: a guard test fails CI if any file in the AI Workforce surface makes a direct provider call, or calls the router without threading a tenant ID. Bypassing the meter is not a code review conversation. It is a red pipeline.
The order inside the choke point is deliberate:
Guardrails
Injection check runs first.Reserve credits
Charged before the provider is contacted.Call provider
Only now does Gemini see the prompt.
A blocked prompt is never charged.
At the cap, you get HTTP 402 — a refusal.
Not a silent overage. Not a top-up charged to your card. Not a "we'll invoice the difference." The call stops.
Bring your own key
On the Business plan you can supply your own Google AI key, and your workspace runs uncapped against it.
The credit pool exists so that AI cost is predictable on a flat monthly price. If you would rather own that relationship directly, Business plans accept your own key and the cap lifts — the metering ledger still records every call, so you keep the usage visibility without the ceiling.
| Plan | Credits / month |
|---|---|
| Free | 50 |
| Starter | 1,000 |
| Pro | 5,000 |
| Business | 15,000 (or uncapped with your own key) |
Simulated runs can never be logged as real work
Every agent run in Oneop is stored with a simulated-or-live marker and badged accordingly in the interface.
This is a governance control, not a demo feature. It means a screenshot cannot be laundered into an audit trail, a sales demo cannot be counted as executed work, and anyone reviewing your run history can tell in one column which runs actually happened.
- No model call
- Zero credit-usage rows
- Null confidence, rendered as an em dash
A real model call, a real credit-usage row, and a model-derived confidence score when the run's scoring pass produced one.
What is written down
Oneop keeps an append-only security-event log that has no delete route, and the schema's tenant boundary is enforced the same way — at the data layer, not by intention.
The internal audit log records events such as logins, multi-factor changes, data exports and data erasures. There is no UPDATE and no DELETE endpoint for it; entries are scrubbed of credential material on the way in; and it can be streamed to an external SIEM over HTTPS with an HMAC-SHA256 signature, at-least-once delivery, confirmed-2xx cursor advance and a retention floor of one year. Separately, every AI agent run keeps its own durable record: the full step-by-step trace, the exit reason, the model, and the token count.
Three completely separate session principals exist with distinct cookies and distinct signing secrets: your staff app, the internal operator console, and the project client portal. In production, boot fails hard if those secrets are not all distinct — a misconfiguration that could blur two principals stops the server rather than shipping quietly. AI inherits all of it: every agent tool call carries the run's tenant ID, and the guard test named above fails the build if one doesn't.
Two things we will not overstate. This is a security-event log, not a comprehensive record of every field change in your workspace. And GDPR tooling covers export of contacts, conversations, tickets and deals and erasure that anonymises contact and user records — real and useful.
Oneop holds no security certification today, and would rather this page said so plainly than let a badge imply one. This is the substitute we can stand behind: named mechanisms, published numbers, and controls with no off switch — all of it open to inspection, none of it a promise.
Frequently asked
Governance FAQ
Can an administrator turn the AI guardrails off?
No. Prompt-injection blocking and PII redaction run on every model call regardless of plan, workspace or setting, and there is no switch anywhere that disables them. A separate layer on top — tool allowlisting, action-value ceilings and confidence thresholds — is configurable, is available on Pro and above, and is switched on when you want it; that layer is the one you can adjust.
What happens when I run out of AI credits?
The call is refused with an HTTP 402 and an upgrade message. Oneop does not bill overage, does not auto-charge a top-up, and does not silently degrade. Usage is always recorded to your ledger; whether reaching the cap hard-blocks the call is a separate switch that is off until you ask for it, so check before you rely on it as a wall.
Is my data used to train models?
Oneop sends prompts to Google's Generative Language API to serve your calls and stores no model-training pipeline of its own — there is none in the codebase. Data handling by the model provider is governed by Google's terms for that API, not by Oneop, and we will not characterise a third party's practices on our own marketing page. Ask us for the current data-processing terms at /trust/dpa.
Which AI provider does Oneop use?
Google Gemini, exclusively — gemini-2.5-flash and gemini-2.0-flash-lite. There is no multi-model routing, no model picker, and no GPT or Claude support. A call requesting a non-Gemini model is served by Gemini.
Can an AI agent touch my accounting or my stock?
Only if someone deliberately switches money and stock actions on, and they are off until they do. While they are off, those actions are fail-closed at the single dispatch point — even in autonomous mode, even after a human approves them. Switched on, they create draft records through the same invariant-safe services your staff use; posting a bill to the ledger still requires a separate human approval.
How do I know a demo run isn't counted as real work?
Because the product stores the distinction and shows it. Simulated runs make no model call, create no credit-usage rows, carry a null confidence rendered as an em dash, and are badged "Simulated" in the runs list and the run drawer.
Read the controls before you trust the AI.
Every number on this page is enforced in code. Start on the free plan and inspect a real run trace yourself.
Sign-up opens when the app launches. We will email you once — no marketing list.