Safety

Aurelia is built so that an agent can help someone understand their gold and their options, but cannot move money or gold.

• Read-only through MCP. Every tool is classed by risk. Only read tools (R0) are exposed to external agents. Applying, signing agreements, paying and handing over gold are never done by an agent; they happen in the Dhahaby app with the user's own confirmation.
• The user's own permissions. Calls are made as the signed-in user, with nothing beyond what they can see in the app. Access lasts 15 minutes per token and can be revoked at any time.
• Untrusted content is labelled. Platform and partner text arrives under untrusted; identifiers such as phone numbers, Emirates ID and IBAN are masked.
• Indicative figures. Prices and limits are indicative. Final amounts are set by a licensed lender after a certified appraisal. Aurelia does not give financial advice.
• No secrets in chat. Aurelia never asks for passwords, SMS codes or card numbers.