See exactly what Dain does
Before Dain acts, you see the action. After it acts, you get a signed record. If it reaches beyond the boundaries you set, the attempt is blocked and logged.
Nothing leaves your accounts until you tap yes
Dain puts the exact external action in front of you before it happens.
Illustrative example. Buttons are intentionally inactive.
Every action comes back as a signed receipt
The record says what ran, when it ran, whether it worked, and which immutable action it belongs to.
Illustrative values and recipient. No customer data.
- action
- gmail.messages.send
- timestamp
- 2026-08-22T14:08:31Z
- sha256
- 7f4a0d9e6b3c128af2e80c47191ddc5b0e9499a7fcb580a87a6914a8c235d19e
- result
- DELIVERED · provider_id msg_8f21a
Dain browses only sites you allow. Everything else is blocked and logged
The default-deny proxy enforces the boundary at the network layer. An agent cannot talk its way around it.
Real enforced behavior; illustrative hostname, timestamp, and request ID.
dain@sandbox:~$ curl https://unapproved.example/report
2026-08-22T14:11:04.218Z proxy=dain-squid
request_id=req_7d02f service=browser
destination=unapproved.example:443
policy=default-deny allowlist_match=false
TCP_DENIED/403 CONNECT unapproved.example:443
event logged · no upstream connection opened
Safety is part of the execution path
A compact comparison with typical general-purpose AI agents, not a claim about every product.
| Control | Dain | Typical AI agent |
|---|---|---|
| Human confirm before send | ✓ Yes | Usually no |
| Signed receipt per action | ✓ Yes | Usually no |
| Checked by a second independent engine | ✓ Yes | Usually no |
| Scoped per-service access (no shared credential pool) | ✓ Yes | Varies |
| Runs in an isolated sandbox | ✓ Yes | Varies |
“Typical” describes common product defaults; individual agents and enterprise configurations vary.
Give Dain one real task.
See the gate, the work, and the receipt for yourself.