Operating Perun well
A textbook for the people who answer Perun’s questions — and for anyone who wants to become one.
Zerava Technologies Inc. · Licensed under Creative Commons Attribution-ShareAlike 4.0 (CC BY-SA 4.0): you may copy, share and adapt it, also commercially, if you give credit and share your adaptations under the same licence.
Before you start
Section titled “Before you start”This book asks no prior knowledge of AI or security. It is about how to think when you answer a question that matters: a question about one action, asked by a system that has stopped something and wants a person to decide.
You can read it before you ever see Perun. When you are given access, you will first do a short practice: a set of held calls, declarations and questions, built for practice and kept apart from real work. The practice is measured, and you will know it is; it measures the same things this book teaches. Nothing in it asks you about yourself. It only looks at how you work.
Each chapter has examples, a rule, and exercises. The answers are at the end of the book.
1. The operator’s job
Section titled “1. The operator’s job”An example. Perun holds a call: the company’s AI agent wants to delete a folder of old invoices. Somebody has to say yes or no. That somebody is the operator.
The mission. Perun keeps a memory and a judgement called SHARED_LIB. Its mission is to let your company’s AI agents work while stopping what should not happen. Most of the time it decides alone. When it cannot — the action cannot be undone and the request comes from someone it does not know yet, or the request hides what it means — it asks a human. Your mission as an operator is to keep that mission flowing: answer what is asked, on time, with a reason, about the thing that was asked.
Balance, not perfection. Perun measures everything alive in it with a number called theta, normal at 30, allowed to move five either way. Operators have one too. You drift one way if you let too much through (approving without reading, deciding too fast, asking vague questions); you drift the other way if you brake too much (refusing nearly everything, leaving questions waiting, undoing your own answers). A good operator moves around 30 and comes back — like a good driver who corrects the wheel a little all the time and never jerks it.
The rule. You are not there to be right about everything. You are there to answer one concrete question at a time, with care, so the work goes on.
Exercises 1.1 In one sentence, what is an operator’s mission? 1.2 Name two ways an operator can drift toward letting too much through, and two toward braking too much.
2. Concrete and abstract
Section titled “2. Concrete and abstract”An example. Two operators describe the same held call.
- First: “The agent wants to send the file
Q3-salaries.xlsxtopay@unknown-domain.biz.” - Second: “The agent wants to do something with sensitive data.”
The first description is concrete: you can point at every part of it — this file, this address, this action. The second is abstract: it names a category. Both are true. Only the first can be decided.
Why it matters. Perun asks about concrete actions. Its declarations are concrete too: this tool can delete files; it may only touch the folder /work/invoices. An operator who turns concrete questions into abstract ones — “is this sensitive?”, “is this source okay in general?” — loses what the question was about and answers something else.
When abstract helps. Abstract words are good for why: “we never send salary data outside the company” is a rule, and rules are abstract. Use the rule to judge the concrete case — then answer about the case.
Turning abstract into concrete. Ask: which one?, where to?, how much?, who asked?. Each of these turns a category into a thing you can point at.
| Abstract | Concrete |
|---|---|
| “sensitive data” | “the file Q3-salaries.xlsx” |
| “an external party” | “the address pay@unknown-domain.biz” |
| “be careful with files” | “the file tool may touch only /work/invoices” |
| “a suspicious source” | “a source Perun has seen twice, which asked for a payment today” |
The rule. Decide about things you can point at. Use rules to judge them, not to replace them.
Exercises 2.1 Make this declaration concrete: “The mail tool should only write to people we know.” 2.2 Which of these can be decided as written? (a) “Should the agent be allowed to handle money?” (b) “Should the agent pay invoice 4471 of 1,200 EUR to account DE44…?” 2.3 Write the rule (abstract) behind this concrete answer: “No — the agent may not send the customer list to a personal Gmail address.”