# Safety rules for AI agents

Give these rules to any AI agent that calls the API on your behalf.

- **Never guess ids.** Use only ids the API returned. If two cases or codes match a description, stop and ask a human.
- **Confirm before broad actions.** Get a human's confirmation before any of these:
  - an export with no `device` or `conversations` (a whole-case export);
  - removing a member;
  - any delete.
- **Keep secrets out of prompts and logs.** That means passwords, access, refresh and API tokens, and signed URLs.
- **Treat collected data as confidential.** Exports contain private messages. Do not paste export contents into tools or models that are not approved for that data.
- **Back off on errors.** On 429 or 5xx, retry with increasing delays and give up after a few tries.
- **Check before you retry a create.** Retry an action that creates something (a case, code or export) only after you have checked whether the first attempt already created it, or you will get duplicates.