An AI money advisor is useful in proportion to what it can do. It is safe in proportion to what it cannot. Most of the design work in Tuvel goes into holding those two apart, and the core of it is a simple idea: every money action needs two keys.
The customer’s key
Each customer chooses a level from 1 to 5. The level says how much the advisor may do for them:
- Observer. Explains and informs. Refuses money actions.
- Assisted. Suggests and drafts. Every money action waits for the customer’s tap.
- Practitioner. Prepares the action, ready to confirm in one tap.
- Senior. Pays known bills and known merchants within the customer’s limit, then tells them.
- Principal. Also turns on autopay and starts monthly investments within the limit.
Levels 1 to 3 are Available now: every money action at those levels is confirmed with the customer’s tap. Levels 4 and 5, where known payments run within both keys and the customer is told afterwards, are On the roadmap.
The bank’s key
The bank holds the other key. It sets the highest level each customer segment may use, and caps per payment and per day that apply on top of whatever the customer chooses. A customer can pick a lower level than the ceiling, never a higher one. The level that applies is the lower of the two.
So if a customer picks level 4 but the bank’s ceiling for their segment is 3, Tuvel behaves at level 3: it prepares the payment and waits for one tap.
Checked when the action runs
The two keys are not a line in a prompt. They are checked by a gate at the moment an action runs, not only in what the advisor says. If something is proposed that the keys do not allow, the gate does not let it through, whatever the conversation says.
Until a bank saves its rules, nothing runs alone, whatever level a customer picks. The default is the safe one.
What no key unlocks
Some actions wait for the customer’s tap at every level, whatever the bank allows: credit applications, balance transfers, redemptions, lump-sum investments, loan prepayment, any payment to a person and any payment to a new merchant. These are commitments, or payments where a mistake is hard to undo, so they always come back to the customer.
Why two keys and not one
A single setting held by the customer leaves the bank no way to match autonomy to risk across segments. A single setting held by the bank treats every customer in a segment the same, whatever they want. Two keys let each side say no. Unattended money movement needs both to say yes.
Every decision the gate makes, including the ones where it says no, is recorded with the turn and the tool call that led to it. A bank can look back and see why an action ran, waited or was refused.