Four facts, kept separate on purpose: her grant, his grant, the organisation’s approval, and the pair — none of them implies another.

The Executive gets a one-page letter in his own terms: what he gets (his EA’s test Brief from her own sources), what will be read (Gmail and Google Calendar, read-only), what Emmre will never do, and three honest choices — Continue with Google · Not now · Grant fewer.

He authenticates directly with the provider on his own page; credentials and tokens never pass through the EA. He can grant fewer, decline, or withdraw on his own page.

The organisation’s approval is recorded separately — pending here — and is never inferred from the Executive’s consent. What IT can see or do beyond its review is not yet decided.

The day is spread across mail, calendar, and Slack; no one system holds the whole relationship — the situation Emmre 2.0 is designed for.

Today — the EA’s page: one sentence about the day, one thing to do, the delivery clock, five readouts, and receipts.

In this sample morning, candidates need her before the Brief she scheduled delivers; one source is stale, and the page says so.

Whether net effort falls is a planned test, not a claim.

Sources & Sync states what was read, by whose grant, when, and what was omitted — and lets the EA reduce scope, disconnect, reconnect, or remain disconnected.

A Sync reads only the currently authorized set and states exactly what was read, when, and what was omitted.

The hollow tick on the rail is that omission: stated on the page, never masked.

Every candidate carries a receipt: why it was shown, which source, whose account, when it was received and processed, and any Memory that raised it.

The receipt goes all the way down: from the item, to the source, to the exact excerpt and the grant it was read under — the excerpt is a quotation, and authority is checked on open, every time, with no cached-authority continuation.

Instruction-like text inside a source is quoted as content and changes nothing in permissions or Memory — by design.

A correction made once influences later recommendations — and names itself when it does.

No login, no app, no habit for the Executive: delivery is email, Slack, and a recipient-bound secure web page that works in a phone’s browser.

A static, table-safe email — Critical then Other — where each Question links ‘Answer on your page’ and protected actions hand off to his secure page; the folio reads ‘If it reached you by mistake, nothing here can be opened.’

In Slack, only what the provider contract safely permits — a question, its choices, or a link to his page; never an open-ended field.

The EA sets when and where the Brief delivers — weekdays, chosen days, weekly, or by hand — plus time zone, weekend behavior, and channel.

A recipient-bound secure web page that works in a phone’s browser — no login, no app, no habit.

Conclusion first, Critical then Other, one typed answer per item, the EA’s recommendation, the source one tap away.

He taps. The controls are replaced by the record, the dashed waiting rule becomes a solid rule, and the loop closes on her page.

A forwarded link shows nothing — not the item, not the recipient’s name — only how to request a Brief addressed to you.

Until he answers, the line under the answer stays dashed — on his page, and on hers.

The answer arrived by reveal — never typed out, so no one is impersonated — and returned to the one loop it belongs to.

Nothing consequential happens without a human; every AI proposal stays labelled proposed until the EA sets it. An answer updates only its own loop; any work it implies is proposed, never created, until the EA confirms.

If the Executive says ‘and send the letter’ (sample), that becomes a proposal on the EA’s page — not a task, not an action — and stays proposed until she confirms it in the Builder.

Tasks & Commitments are lightweight, pair-bound, and human-confirmed: Emmre detects; you confirm. A detected completion stays open until a human says it is done — confidence is never authority.

Emmre Memory is typed — Instruction, Preference, Observation — scoped to one pair, visible on every item it touched, and the EA’s to review, confirm, edit, pause, resume, or delete.

Instructions lead Preferences; Preferences lead Observations. Nothing crosses pairs. An Observation never silently becomes an Instruction; conflicting Instructions pause until the EA chooses.

It learns only through corrections the EA can see, pause, and delete.

Trust & Data is designed to show everything Emmre holds for the pair, who can see it, and how to remove it: request an export, remove per-source-derived data, or delete this pair’s data; isolation is pair-only; every protected event keeps actor, action, object, before/after, time, reason, and source.

By design, deletion and revocation win every race with queued work and propagate to derived items, Memory, indexes, and provider processing; removal is recorded store by store.

A withdrawn grant stops reads at once, withholds what was derived, records removal, and Emmre never re-grants on the Executive’s behalf — by design.

Telemetry records clicks, Sync runs, and delivery outcomes — never message bodies. Engagement is not counted as impact.

Emmre staff — bounded, audited interventions only.

IT gets its own page, in document register: what is read, how it is kept apart (reads pair-only; writes none; credentials never pass through Emmre; revocation stops reads at once), which control-evidence categories exist, the recorded organisational status, and — in the product’s own words — what is not claimed.

Emmre reads only what each person authorizes, keeps every identity separate, and shows its sources. Revoke access at any time; deletion means deletion.

Emmre does not claim SOC 2, a signed DPA, WCAG conformance, or a security certification here.

Customer content is not used to train shared foundation models — an approved rule of the product; retrieved content cannot act as system instruction or authority.

Exact provider scopes, the IT object/action matrix, secure-link lifetime, retention, and the continuity mechanism are not yet decided — the product says so on its own pages.

Four things are listed and not yet open: Impact evidence, Continuity verification, Purchase research, Copilot. The product says so on its own contents page.

There is no chat. Copilot is listed and not yet open; if it opens, it is EA-only, answers only from this pair’s granted sources, and declines the rest. An answer never acts, sends, or changes a permission on your behalf.

In this release Emmre performs no autonomous consequential action: no autonomous email, calendar change, Slack reply, commitment, spending, deletion, impersonation, purchase, or irreversible action.

Not in V1: write actions, other integrations, multiple Executives, a native mobile app.

Impact evidence is designed to show what moved forward, never how busy you were — this view opens after its evidence gate.