An AI agent that operates your app for the user: actions, screens, and what it can never do
Published 13 October 2026
Give the assistant your app's actions (the API calls it may make) and your app's screens (the places it may open), and let a server check every use of both. In Rendel, reads run at once, changes wait for the user's confirmation, and a screen opens through your app's own navigation only if the app registered it.
Actions: what it may do
An action is one of your API calls, described once: its name, what it does, its parameters and whether it reads or changes data. Rendel validates the parameters against the schema before anything runs, and calls your API with the signed-in user's own token.
Reads, such as listing orders, run straight away. Changes, such as a return or a transfer, stop at a confirmation card that Rendel's server builds from the action, and run only after the user taps yes.
Screens: where it may take the user
Some answers end on a screen the user already has: the order, the subscription, the settings. Register those screens with registerRoute, and Rendel can offer one on a card or a button; a tap opens it through your app's own navigation. Opening a screen changes nothing, so it needs no confirmation.
A parameter that identifies something, such as an order id, can be marked fromActions: it must equal a value one of your actions returned in this conversation, so the model cannot invent the id that opens a screen.
What it can never do
These are checked on Rendel's server before a reply reaches the device.
| It cannot | Because |
|---|---|
| Call something you did not register | Only actions you registered in code or enabled in the console are offered |
| Open a screen you did not register | Every navigation is checked against your registered screens and their parameters |
| Change data without a tap | A change runs only after the user confirms the card |
| Show a phone number, address or map pin you did not give it | Those must come from one of your actions' results |
| Draw something your build cannot show | It is offered only the components your build says it can draw |
Questions
Does the model see our API keys or tokens?
No. The model sees your actions' names, descriptions and parameter types, the app state you pass, and the conversation. The call itself is made with the signed-in user's token.
Can we turn an action off quickly?
Yes. An action disabled in the console is refused from the next turn, without a new release of your app.