Concepts
Five ideas explain everything PowerExecutor does.
1. The operating loop
PowerExecutor doesn't run workflows — it runs a loop, once per cycle:
Observe → Understand → Prioritize → Act → Verify → Reflect- Observe — poll the product's signals (analytics, health, content state).
- Understand — turn raw signals into situations using an LLM, grounded in evidence.
- Prioritize & Act — decide what to do and carry it out within the granted freedom.
- Verify — confirm the action had its intended effect.
- Reflect — record the outcome, which feeds earned autonomy.
2. The Product Digital Twin
A bounded picture of the product — not "complete". Every fact carries a timestamp, a source, and a confidence, and missing knowledge is recorded as an explicit unknown rather than guessed. If a signal can't be observed, the cycle degrades gracefully instead of inventing state. Unknowns are reset at the start of every cycle, so a report only reflects the run that produced it.
3. Capabilities & the adapter
Everything the operator can do to a product is a capability — publish a post, send a broadcast, update content. Capabilities live in a declarative adapter spec (a YAML file) that maps each one to the product's real API and declares its risk and how to undo it:
| Reversibility | Meaning |
|---|---|
reversible | Prior state is captured and can be fully restored. |
compensable | Can't restore exactly, but a compensating action mitigates. |
irreversible | No meaningful undo (e.g. a sent email) — always needs approval. |
Because products are described by specs, PowerExecutor is product-agnostic: adding a product means writing a spec, not changing the core — and you do it entirely from the console's Adapters view. See Adapters & products.
4. Earned autonomy
Trust isn't granted by a flag — it's earned. Every capability sits at one of three levels:
👁 Watch only (Shadow) simulates the action — never touches the product 🙋 Ask me first (Recommend) proposes and waits for your approval 🤖 Act alone (Autonomous) acts on its own
New capabilities start at Watch only. Three consecutive clean outcomes promote a capability one level; any failure demotes it and resets the streak. You can promote or demote manually in the Permissions view. Irreversible capabilities stay approval-gated at every level.
5. The safety envelope
- Kill switch — denies every action instantly until you disengage it.
- Degraded mode — pauses acting after an anomaly; observation continues.
- Action budget — a per-day cap on real actions.
- Action receipts — every real action writes an immutable record (before/after state, result) so it can be reviewed and reversed.
- Supervisor PIN — every consequential action requires it.