# Leo, the AI agent

> Source: https://whisperer.one/llms/agent.md · Whisperer machine-readable layer.
> Product overview: https://whisperer.one/llms/product.md · Full corpus: https://whisperer.one/llms-full.txt

Leo is the AI agent built into Whisperer. It works on the user's own data through the same
tool registry the interface uses, so there is no second implementation to drift.

## What Leo can do

Leo reads and acts across meetings, calendar, tracker, files, knowledge base, prompts, support
tickets, account settings, integrations and its own memory. Concretely: find what was said and
decided in past conversations, trace a topic across meetings, answer with the source, create
and move tasks, create and update calendar events, read and analyse stored files, search the
knowledge base and the web, and remember what matters about the user between sessions.

## Boundaries that no setting removes

- **Only the token owner's data.** Every tool is scoped to the person who asked.
- **Irreversible actions require a human.** Deletions are guarded by a confirmation with a
  server-rendered preview of exactly what would be affected.
- **Evidence, not assertion.** Commitments and decisions carry a mandatory source — which
  meeting, which moment, who said it — and Leo answers "why do you think that" with the source.
- **A hub conversation sees only that hub's meetings.** The scope is a resolved list, not a
  filter the agent can widen.
- **Access granted to Whisperer is not passed on.** Tools that act inside the user's other
  services — mail, chat, CRM, connected drives — are never projected to external MCP clients.

## Memory and initiative

Leo keeps long-term memory of stable facts and preferences (see `/llms/memory.md`). Deferred
errands — "remind me in an hour", "send this next week" — are stored as a first-class record
of what the user asked for, and are executed on time independently of what happened to the
system in between.

Proactive behaviour is deliberately conservative and shipped behind switches that default to
off: the agent having a reason to speak is not the same as it being welcome to.

## Reaching Leo's capabilities from outside

An external AI client reaches the same registry through the MCP server, minus everything on
the deny list. See `/llms/mcp.md` for the exact projection, the scopes and the limits.