Glass-box AI: consent before action

The easiest way to ship AI features is to pipe your data to a model and hope you like the result. We don't do that. Across the Twin suite, intelligence features follow one rule: nothing leaves your device without a consent step that shows you the exact payload first.

Local by default

Classification, importance scoring, and entity extraction run on-device. They're fast, they work offline, and they never cross a network boundary. For most of what "AI" does in an inbox, that's enough — and it's the default.

The boundary crossing

Some actions genuinely benefit from a larger model: summarizing a long thread, drafting a reply, answering a question across many messages. Those cross a boundary, so we treat them as a boundary: a consent sheet appears showing the precise content to be sent, you approve it for that one action, and both the request and the response are written to an encrypted audit log. Drafts are pre-fill only — we never auto-send.

Why "glass-box"

The consent sheet shows the exact text about to leave your machine and names the provider that will receive it. Approve it, and both the request and the response land in the encrypted audit log. You can always answer "what did this feature just send?" — the answer is on the screen, and then it's in the log.

We treat that consent sheet as a release gate, not an optional post-launch check. A feature that can't show its payload doesn't pass review, and there's no second tier where the rules relax.