Let customers move money by asking, with nothing changing until they tap yes
Published 13 October 2026
Your customers can ask your app to do things, like send money or freeze a card, and nothing changes until they confirm it on a card that Rendel's server builds from your own action. Questions that only read data are answered straight away.
Reading is instant, changing waits for a yes
Every action you give Rendel has a risk level. A read, like showing this month's spending, runs as soon as the customer asks and comes back as a page of your app's own screens.
A write, like moving money between accounts or changing a limit, never runs on the model's say-so. Rendel stops, shows a confirmation card, and waits. If the customer taps no, or never answers, nothing changes.
| Kind of action | Example | What happens |
|---|---|---|
| Read | “Where did my money go this month?” | Runs at once and answers with a page |
| Write | “Move 500 to my savings.” | Shows a confirmation card, runs only after the tap |
| Destructive | “Close this card.” | The card warns it cannot be undone, and nothing is pre-selected |
The card comes from your action, not from the model
The confirmation card is built on Rendel's server from your action's own template and the parameters it has already validated against your schema. The model never writes the card, so it cannot word a request one way and run it another.
The wording on the card is yours: you write the confirmation sentence when you add the action, and you can give it in each language your customers use.
A tap the device cannot fake
With server-mediated confirmation switched on, the yes is recorded by Rendel's server, checked against the app, the device that asked and a time limit, before your handler runs. A result reported as a success without that confirmation is recorded as declined.
It runs as your customer, under your rules
When the customer confirms, the action calls your own API with the signed-in customer's own token, so your existing permissions and limits still decide what is allowed. Rendel does not get a back door into your systems.
If you switch an action off in the console, it is refused from the next turn, without a new release of your app.
Every action is on the record
Each action that runs is kept with the conversation: when, on which device, the parameters, who confirmed it and what came back. Your team reads it in the console, and owners can export it.
Questions
Can the assistant approve a transfer on the customer's behalf?
No. A write runs only after the customer confirms it on the card. Without that confirmation it does not run, and a success reported without one is recorded as declined.
Can we stop an action straight away if something looks wrong?
Yes. Switch it off in the console and it is refused from the next turn, with no app release.
Does the model see our customers' account data?
It sees the names, descriptions and parameter types of the actions you allow, the app state you choose to pass, and what your actions return in the conversation. Emails and card numbers that users type are masked before the model sees them.