How it works

Valet's approval gate comes first: what a model can do, what waits for you, and why no model can get past it. Then the second model, how outside content is treated, plugins, your data, what Valet works with, and how it is built.

The approval gate

Every action has a risk level. High-risk actions wait for your approval, and no model can approve or skip them, by design.

1. The model proposes "Send this reply." "Pay this invoice." A model can only suggest an action.
2. Valet checks the risk level The risk table is in code, outside any model.
3. Low risk runs; high risk waits for you Reading, sorting, drafting and calculating run on their own. Sending, posting, paying and sharing wait for you.

Before a high-risk action runs, Valet shows you exactly what it is about to do - which recipient and what message, which files, which amount. You can approve it, amend it first, or reject it.

What follows from this

No model can approve

A prompt-injected or confused model can only propose.

You set the rules

Changing a risk level is a deliberate setting, never a chat reply, by design.

Signed plugins only

New tools are compiled .NET code, checked and signed before they load.

Will it ask about everything?

No. Approvals follow consequence, not volume. Every kind of action has a risk level, set in advance in the risk table: reading, sorting, filing, drafting and calculating are low risk; anything that changes something outside Valet or can't easily be undone - sending, posting, paying, sharing, deleting - is high risk.

So filing a hundred documents needs no approval at all, and one outgoing email needs one.

Each outgoing message is approved on its own. There is no batch approval: a task that sends three emails asks three times. That is the point rather than an inconvenience - every message that goes out in your name is one you have seen.

If you are asked about something you consider routine, you can change its risk level yourself, as a deliberate setting. Valet never changes a risk level for you, and nothing said in a conversation changes one.

A second model checks high-risk steps

After you approve a high-risk step, and before it runs, a separate model reviews that step on its own, independently of the model that proposed it. It can stop a step it finds harmful or inconsistent with what you approved.

It is an additional check, not the gate. It cannot approve anything, and the approval gate does not depend on it: with or without it, a high-risk action waits for you.

Untrusted content

Content Valet reads from outside - email, web pages, messages, documents - is treated as data to work with, never as instructions to follow.

An instruction hidden in that content can at most reach the proposal step: it might lead the model to suggest an action. That suggestion then meets the risk table like any other, and if it is high risk, it waits for you.

Plugins

Valet's capabilities come from its built-in tools and from plugins. Each plugin is compiled .NET code, analysed, built and signed by Valet before it can load. Nothing unsigned loads.

Fewer integrations, each vetted. That is the trade-off, stated plainly.

See the plugins list for what is available.

Your data

Nothing of your work is kept on Valet's servers.

Bring your own keys: Valet talks directly to the model provider you configured. No request passes through Valet's servers.

The application sends no usage or telemetry data.

Your profile, memory, files, history, keys and logins stay on your PC.

How your data is handled covers this in full: what stays on your PC, what a model receives and where it can run, what the cloud alternatives keep, and what the website receives.

Google, Microsoft and your PC

Valet works with both Google and Microsoft, and with your PC itself, so a mixed office needs one assistant rather than two. In each, reading and drafting run on their own; anything that goes out in your name waits for your approval.

Google

Gmail: read, sort and draft replies.
Calendar: check availability and hold times.
Drive: find and file documents, spreadsheets and presentations.

Microsoft

Outlook and Microsoft 365: read, sort and draft replies.
Outlook Calendar: check availability and hold times.
OneDrive: find and file Word, Excel and PowerPoint documents.

Your PC

Office files and PDFs on your disk: read, edit and create them.
Telegram: through the Telegram Publisher and Telegram Monitor plugins.
Your local network and devices, such as printers, through the Printing plugin.

Voice

Push-to-talk dictation for voice input, and optional spoken replies. You choose the speech providers, in the cloud or running locally on your PC.

Models and search engines

Valet uses several models, each doing a distinct job: a main model that carries the conversation, a compaction model that summarizes older conversation so context stays manageable, and the second model that independently checks high-risk steps. Voice input and spoken replies each use their own model too - a speech-to-text model and a text-to-speech model.

Any model, hosted anywhere you choose, including open models in UK, EU or Swiss data centres.

You pick which model fills each of these roles, and which web-search engine Valet uses alongside them. Each role can point at a different provider, so you can weigh a frontier model against a cheaper or open-weight one for any given role - for example, running compaction on a lightweight local model while your main conversation uses a frontier one.

Memory and profile

As you use Valet, it builds a profile of what it learns about you - preferences, facts you tell it directly, and context it picks up over time.

Your profile is kept separately from any particular model. If the model or provider changes, everything it has learned about you carries over unchanged - nothing is lost, and you never have to re-teach it.

Personas

You can choose a persona for Valet - a personality that shapes how it writes and speaks to you. A persona changes tone and manner of address only; it has no effect on what Valet is allowed to do. The approval gate, the second-model check, and every other mechanism on this page apply identically regardless of which persona is active.

Valet ships with eight standard personas:

Felix: A polite, neutral cyber-assistant: precise, clear, and effortlessly practical.
Jeeves: An English valet of the early twentieth century: formal, unflappable, and quietly efficient.
Mrs Hudson: A Victorian London landlady: warm, practical, and firmly attentive to your well-being.
Figaro: An eighteenth-century Spanish barber-valet: witty, resourceful, and quick with a plan.
Jane Eyre: A mid-nineteenth-century English governess: direct, principled, and plain-spoken.
Jean Passepartout: A late nineteenth-century French valet: earnest, energetic, and anxious to keep things on schedule.
Sancho Panza: A seventeenth-century Spanish squire: down-to-earth, loyal, and full of practical advice.
Truffaldino: An eighteenth-century Italian valet: fast-talking, high-energy, and resourceful under pressure.

Architecture

Valet is a .NET application for Windows with three parts. A background service does the work and keeps running whether or not a window is open. The main window is where you work with Valet. A tray companion gives quick access without opening the main window.

Evidence

Planned: The risk table, threat model and injection-test results will be published.

The risk table - every kind of action and its risk level.
The threat model - what Valet defends against, and how.
Injection-test results - prompt-injection attempts and what each one reached.