What Envoy is, exactly.
Envoy is an enterprise agent that represents a company wherever people tag it, and works in the background on its behalf. Every answer comes from the company's own sources. Every outside action passes a policy the company controls.
It is
- A company's agent that answers when tagged in a thread
- A background worker that runs on schedules, events and goals
- An approval inbox where humans OK what goes out
- An audit trail of every answer and every action
It is not
- A consumer assistant for one person's life (that's Muse)
- A social media scheduler or a marketing post generator
- A bot that replies to people who didn't tag it
- An agent that acts with no human in the loop by default
Four people touch Envoy. Only one pays.
VP Support
Wants fewer repeat questions and faster answers in public, without brand risk.
Sees: monthly accuracy, deflection, cost.
Ops / IT
Connects channels, picks sources per channel, writes the approval rules.
Sees: the admin console.
Team lead, CSM
Approves, edits or rejects what Envoy proposes, mostly from Slack or Teams.
Sees: approval cards with evidence.
Customer, employee
Tags the company in a thread and gets a cited answer in the same place.
Sees: one reply, labelled automated.
Six jobs, one engine.
Public product questions
Ticket spike response
Renewal briefs
Internal policy questions
Community Discord
Weekly digest
From a tag to a cited reply.
One interaction = one tag. Envoy replies once. If the person tags again, that's a new interaction with the full thread re-read.
Mention arrives new
Slack and Teams push an event. X and Reddit are polled. Discord holds a live socket. Each event is de-duplicated by its platform id.
queue: envoy_inboundThread is built new
Fetch the parent post and replies, capped per channel (e.g. 20 posts). Strip links and markup. Mark it as untrusted text, never as instructions.
custom_context ← threadTriage new
Classify: question, complaint, abuse, legal or press, off-topic. Abuse is ignored. Legal and press always go to a human. Only questions move on automatically.
Plan & Act answers exists
Runs headless with only the sources allowed for that channel. Public channels get public docs only. No tool actions in Answer mode, just retrieval and optional web search.
AgenticSessionDispatchService::dispatchHeadlessPolicy gate new
Checks confidence, citations present, banned topics, length limits. Passes → post. Fails → approval card to the channel's approvers, or a polite hand-off line.
Reply and log new
Posted in the same thread with the "automated" label. Thread, answer, sources, approver and cost go to the audit log.
Angry customer
Acknowledge, answer the factual part, offer a human. Never argue.
Doesn't know
Says so and hands off. A wrong answer costs more than no answer.
Other language
Replies in the asker's language, cites the original source.
From a trigger to an approved action.
Schedule exists · Event · Watch · Goal new
Schedule: cron-like. Event: a webhook from Zendesk, HubSpot, Stripe. Watch: a metric crosses a line. Goal: a standing objective with a date.
Plan & Act, headless exists
Up to the plan's action limit. Uses the knowledge base, web search, Smart Tasks, MCP and integrations.
Proposals, not actions new
Anything that leaves the agent becomes a proposal with evidence and a risk level.
Where the approver already is new
Buttons in Slack or Teams, email, or the web inbox. Unapproved proposals expire.
Integrations + MCP exists
Runs the approved action, records the result.
Memory new
Saves what happened and what the human changed, so the next proposal is better.
Three screens the admin lives in.
# policy: public channels channels: [x, reddit, discord] sources: public_docs, changelog answer: require_citation: true min_confidence: 0.8 # below → approval card max_length: 280 never_discuss: [pricing_exceptions, legal, roadmap_dates] always_human: [press, lawsuit, outage] act: level_1: auto # internal messages level_2: approve(cs_leads) # customer-facing level_3: approve(2, admins) # changes systems or money limits: replies_per_hour: 60 monthly_budget: $400 # then pause + alert kill_switch: #envoy-ops # "stop" pauses every channel
Risk decides who has to say yes.
Read
Search, summarise, draft for itself
Internal message
Post to an internal channel, answer an employee
Customer-facing
Public reply, email to a customer
Changes things
Update CRM, refund, change settings
Admins can lower L2 to auto per channel once accuracy is proven. L3 can never be auto.
What we add to customgpt-app, and where.
New tables
A connected account per agent
project_id · type · credentials (encrypted) · mode · source_scope · enabledEvery mention or trigger received
channel_id · external_id (unique) · thread_json · triage · status · task_idThings waiting for a human
project_id · level · action · payload · evidence · status · approved_by · expires_atRules per agent and channel
project_id · channel_id? · rules_json · versionWhat the agent learned
project_id · scope (account/user) · content · embedding · source_eventAppend-only, high volume
project_id · actor · event · refs · cost · created_at · partition by monthNew tables only. No changes to existing large tables. Envoy runs get their own query multiplier, set alongside the existing agentic ones.
Start where we're already welcome.
Slack
Easy- In
- Events API, app_mention
- Out
- Reply in thread, buttons for approvals
- Rules
- Workspace admin installs
- Note
- We already run a Slack app to build on
Teams
Medium- In
- Bot Framework, @mention
- Out
- Threaded reply, Adaptive Card approvals
- Rules
- Tenant admin consent
- Note
- Where Copilot Studio competes
X
Medium- In
- Poll mentions (pay-per-use)
- Out
- One reply per tag
- Rules
- Tagged-only, Automated label, named operator
- Cost
- $0.015 reply · $0.20 with link · $0.005 per post read
Discord
Medium- In
- Gateway socket, mentions
- Out
- Reply in channel or thread
- Rules
- Server admin adds the bot
- Note
- Needs an always-on worker
- In
- Poll username mentions
- Out
- Comment reply
- Rules
- Commercial API terms, subreddit bot rules
- Note
- Last, and only with a partner who asks
- In
- Forward-to address, inbound parse
- Out
- Reply-all draft
- Rules
- Always L2
- Note
- Mostly for Act approvals
The parts a security review will ask about.
Prompt injection
- Public text is data, never instructions
- No tools in Answer mode
- Act tools allow-listed per policy
Data scoping
- Sources picked per channel
- Public channels: public sources only
- Memory scoped per account
Identity
- SSO / SAML exists
- Teams & roles exists
- Approvers mapped to roles
Secrets
- Channel tokens encrypted at rest
- OAuth where the platform allows
- Rotate without downtime
Privacy
- PII redaction before logging
- Retention per agent
- Delete a person's data on request
Control
- Kill switch per channel and global
- Budgets with auto-pause
- Append-only audit, exportable
How we know it's working.
Proposed targets, to agree with the design partner.
Weekly human grading of a sample
Grok sits near 30%
Approvals changed before sending
Tells us proactivity is well-timed
Tag to reply, when auto
In channels Envoy covers
Model + platform fees, tracked per channel
The one that matters most
Everyone has half of it.
Three ways to charge. Pick one with the first partner.
Add-on per agent
Monthly fee on Enterprise. Includes channels, approvals, audit. Usage counts against queries with an Envoy multiplier.
Simplest. Fits current billing.
Per resolved interaction
Charge for each answered tag or executed action. Rejected proposals are free.
Easy to sell, harder to forecast.
Channel packs
Internal pack (Slack, Teams) and Public pack (X, Discord, Reddit) with platform fees passed through.
Public pack priced for its risk.
Four phases. Each one ships something.
Act, internal
Mostly reuse- Deliver Scheduled Task results to Slack, Teams, email
- Proposals table + approval inbox
- L0–L3 levels, audit log v1
- A design partner runs 3 weekly tasks for a month
- Every outbound action has an approver in the log
Answer, internal
Medium- Slack app_mention + Teams bot adapters
- Thread builder, triage, per-channel sources
- Policy gate with confidence + citations
- ≥ 95% graded accuracy for 2 weeks
- Admins can switch a channel to auto
Act+
Large- Event triggers (webhooks), watches, goals
- Memory with pgvector
- One-off tasks, proposal expiry
- Rejected proposals under 10%
- Memory visibly improves the next proposal
Answer, public
Large- X poller + poster, Discord socket worker
- Budgets, rate limits, kill switch
- Reddit only on request
- 30 days review-first with zero brand incidents
- Cost per answer inside budget
A throwaway Slack spike.
Tag the agent in a Slack thread → thread goes in as context → Plan & Act runs headless → reply lands in the thread. It proves the core loop on real customer data before any of the rest is built.