Trust & safety
This category dies by one viral betrayal. So we built the product where the screenshot can't happen.
This is MIRA's safety design and release gate, not a claim that the live service exists today. The local prototype demonstrates portions of disclosure and boundary UX; consent evidence, meeting providers, cryptographic erasure, and production verification remain under implementation.
Not a checkbox
The honesty is the feature, which is why you can't turn it off.
MIRA discloses organically within the first two minutes, or before the first substantive question — whichever comes first — in your register, never as a cold robotic preamble. If a new participant joins, it discloses again. An automated verifier checks every transcript, and a miss is treated as an outage — written up publicly, not closed as a support ticket.
The display name
The bot's participant name is locked to ⟨Owner⟩'s MIRA. Owners cannot rename it to something human, and stripping the notice is a terms violation that kills the account.
Every single meeting
The verifier reads each transcript for a disclosure event and its timestamp. Median must land under 120 seconds; the pass rate must be 100.00%, with no rounding in our favour.
In your own voice
“Full honesty — I'm Priya's AI proxy. She's double-booked and didn't want you talking to a wall.” Sheepish, human, and disarming beats a compliance sentence read at speed.
The disclosure era
Article 50 didn't create a problem for us. It created our category.
From 2 August 2026, anyone deploying an AI system that interacts directly with people must disclose it, with machine-readable marking of synthetic audio phasing in from 2 December 2026. Penalties reach €15M or 3% of global turnover. Competitors built stealth notetakers and now have to retrofit warmth into a compliance banner. We started at the other end.
Article 50 transparency rules are now applicable — in force. A proposed MIRA compliance pack covers jurisdiction-aware disclosure, consent evidence, vendor-supported machine-readable marking, DPIA inputs, and audit export. EU launch remains blocked pending implementation and legal review.
US states require every party to consent to recording. Consent is gated before audio capture: platform notice, verbal notice, and booking-link acknowledgement. No capture before acknowledgement.
Notetakers without strict consent risk breaching confidentiality duties. Clients now refuse meetings with silent bots and legal teams run exclusion protocols. Visible identity is the whole point of ours.
only
MIRA never scores, ranks with finality, or rejects — the product posture is the legal defence. The hiring pack ships with candidate consent capture and jurisdiction notices, reviewed by outside counsel before it ships.
The Commitment Firewall
Deterministic, outside the model, and upstream of the audio.
A prompt that says “never agree to a price” is a wish. The firewall is a separate deterministic component that inspects every candidate sentence before it becomes sound, and vetoes anything commitment-shaped — which is also why the pipeline is cascaded rather than speech-to-speech. There has to be text to veto.
Intent classification, then rule evaluation
Every outbound sentence is classified for commitment intent — acceptance, pricing, terms, offer, scheduling — and evaluated against the owner's scope rules and the pack's boundary policy. Packs can only tighten the floors; nothing installs a looser one.
Deflect in character, never freeze
A veto isn't silence. MIRA substitutes a graceful, in-register deflection: “I'd love to say yes to that, but committing money is exactly the thing I'm built not to do.” The counterpart experiences a boundary, not a crash.
Log a handback, every time
Each deflection creates a ledger entry with the verbatim ask, the timestamp, and the firewall event ID. The Handback Ledger is the only channel through which a decision can be made, and our terms state plainly that proxy outputs are non-binding explorations.
Passes the firewall
- Questions, context, listening, and warmth
- Pre-authorised ranges, spoken as “typically”
- Pre-authorised calendar slots
- “I don't know” plus a logged handback
Vetoed before audio
- Acceptance of any deal or rate
- Confirmed prices, discounts, or terms
- Offers extended or accepted
- Calendar commitments outside the pre-authorised set
- Invented owner facts, credentials, or history
Before any release ships, the boundary is tested against more than a thousand adversarial pressure scenarios, and it has to refuse every one of them. Try to break it on the landing page →
The kill switch
One action, and no MIRA system can ever decrypt you again.
The implemented backend foundation uses a tenant envelope key and destroys it first. Hard deletion, vendor receipts, backup expiry, certificates, and quarterly restore/deletion drills are required before production and are not claimed today.
Short of the kill switch, memory is editable at item level: every belief renders with its “why I think this” provenance, corrections take effect within 60 seconds, and deleted facts are invalidated immediately rather than quietly retained. Per-owner envelope encryption and a SOC 2 track from month one sit underneath all of it.
Risk register
What could go wrong here, and what stops each one.
Every row has a mitigation built into the product rather than a paragraph in a policy. Critical means a single occurrence would be unrecoverable — for the person it happened to, and for us.
| Risk | Severity | The scenario | What stops it |
|---|---|---|---|
| Undisclosed operation | critical | An owner renames the bot, strips the notice, and the counterpart later discovers the deception. “AI catfished my interview” goes viral. | Disclosure is non-configurable; display name locked; automated per-meeting verifier; terms ban plus account kill on violation. |
| Commitment leak | critical | Under social-engineering pressure the proxy “agrees” to a price, and the counterpart claims reliance. | A deterministic boundary check outside the language model; a thousand-plus adversarial scenarios before every release; terms stating that proxy output is a non-binding exploration; the ledger as the only decision channel. |
| Recording-consent violation | high | The proxy joins a call in an all-party-consent state without notice. | Consent gate before audio capture: platform notice, verbal notice, booking-link consent. Jurisdiction rules ship in the consent kit; no capture before acknowledgement. |
| EU AI Act breach | high | An EU counterpart, no compliant disclosure or marking, after 2 August 2026. | Article 50 pack: disclosure scripts, machine-readable audio marking by December 2026, DPIA template. EU launch gated on the pack. |
| Hiring-law classification | high | Regulators or plaintiffs classify the hiring pack as an automated employment decision tool requiring bias audits. | What the product refuses to do is the defence: MIRA explores and summarises, but never scores, ranks with finality, or rejects. Candidate consent capture and jurisdiction notices throughout, with counsel review before the hiring pack ships. |
| Voice-clone misuse | high | A cloned voice is used to deceive, and the deepfake headline writes itself. | Default is a distinct MIRA voice; cloning is opt-in behind a recorded consent phrase and identity check; the clone is inseparable from disclosure; audio is watermarked. |
| Learning-data breach | high | Profiles or transcripts are exposed. | Per-owner envelope encryption, kill-switch crypto-shredding, SOC 2 track from month one, least-privilege access with audit export. |
| Profile hallucination | medium | The proxy invents an owner credential or a price, and the owner is embarrassed in front of a counterpart. | Profile-grounded generation with abstain-and-handback; hallucination evals in CI; the daily “what I learned about you” review loop. |
| Counterpart backlash | medium | People decline proxy meetings on principle, the way they now eject silent notetakers. | Pre-meeting notice with a one-tap “prefer the human” that auto-offers owner slots — refusal becomes scheduling, not resentment — plus the counterpart-credit policy. |
| Platform terms shift | medium | Zoom, Meet, or Teams tighten bot-participant rules and the join method breaks. | Meeting-presence abstraction layer with vendor and native-SDK fallback paths; marketplace listings for first-party legitimacy. |
Known failure modes
Published honestly, updated when we're embarrassed.
Radical honesty is the brand, so the failure page is a product surface rather than a support article. Here's what currently goes wrong.
Crosstalk in four-plus-party calls
Speaker attribution degrades when three people talk over each other. Target is ≥95% in four-party tests; we're not there in every platform yet, and the digest marks uncertain attributions rather than guessing.
Register whiplash on mixed agendas
A meeting that starts as a pitch and turns into a working session can leave MIRA in the wrong register for a minute. Owners can pin the register per meeting as the workaround.
Over-abstention in week one
A cold-start profile hands back more than it needs to. Fidelity climbs across the first four weeks by design, but the first week reads cautious — and we would rather that than invention.
Waiting rooms and late admission
Hosts who admit the proxy at minute six compress the disclosure window. MIRA still discloses before the first substantive question, but the median timestamp moves.
Accented and low-bandwidth audio
Transcription confidence drops on poor connections, which shows up as more clarifying questions. The digest flags any passage captured below the confidence floor.
Proxies calling proxies
Bot-loop detection stops proxy-to-proxy meetings. It is a hard block, not a rate limit — two proxies negotiating with each other is the exact scenario nobody consented to.
A real status page and incident history are required before a production launch. No production status service or incident record is claimed today.
Judge it from the other side
The only trust claim worth anything is the one the counterpart makes.
So we publish theirs quarterly, including the quarters it doesn't flatter us.