Your playbooks — and the fence they run under
A playbook is an agent request in your own words — 20 come baked in, and you can author your own. Each runs on your connected provider through Leif's governed engine: admission, kill-switch, a signed receipt for every crossing. Heim is that fence — it vets what comes in, gates what an agent reaches for, and holds the halt. Neither outranks the other: a playbook is what an agent may do; Heim is the terms it does it under.
The three tabs are the three questions: Activity is what already happened, Playbooks is what an agent may do, Rules is the terms it does it under. Stop everything sits above all three because a halt must never be a tab away.
What Leif can't see. Agents that live entirely inside a walled remote garden and never cross Leif's doors are invisible here. Discovery scans only what crosses Leif — agents on the receipt spine, locally-detectable CLIs and MCP servers, and invited peers. So an empty Activity list means nothing called Leif, which is not the same as nothing happened.
Leif Laws
the bindings that hold unless you loosen themThese protections are already on. You're likely not legally bound as a personal user — this is about running agents you can actually trust. Set the one dial, and the seven laws below do the rest.
Your rules
pick what Leif asks about, and what it refuses outright—The 7 Laws above already hold. These are the specific crossings you want a say in. Watch just records it — no pause, no refusal, nothing extra to pay for. Ask pauses the call and waits for you; Lock refuses it outright, on every posture. Every one of these binds in two places — work Leif routes for you, and a tool your assistant calls directly. None can lower the floor.
Ambiguous routes
who breaks a tie when the rules cannot—Containment
how much an agent may do — least power first—Posture
how strict Heim is, right now—Your playbooks
real tasks · your words · run them here—Author a playbook
＋ new, or edit any card above · core verbs reset · custom ones delete0$active step are locked (edit instruction / capabilities / on-off only). Reset restores the baked-in default.The floor
immutable · always refusedThe band
earned autonomy · user ∧ appConnectors Heim admitted
outbound MCP servers · vet verdict + live behaviour0Custom rules
deny / allow above the floor · this rule-settool for a catalog-independent hard block. (The immutable floor, not custom rules, is the catastrophe backstop.)