Instructions

Instructions

These seven files tell the AI its name, how to speak, and how to do its job.

Like a school handbook. It explains the way to do things.

• Name and speaking style.
• Language, time zone and work instructions.
• How to ask for tools, notes and reminders.

Instructions guide the AI. The permission checker decides which actions are allowed.

Permissions

The agent checks who is asking, where they are asking, and what they may use.

Like checking a name at the school gate. A name in a message is not an ID.

• Founders manage the agent from verified private chats.
• Staff use only the data they are allowed to use.
• Groups have their own approved people and data.

USER.md holds company language and time zone. Staff access is stored in control.json.

Tools

The AI has one protected tool menu. It can ask for approved actions from that menu.

Like a pencil case. You can only use the tools that are inside.

• Read allowed app data.
• Change an exact Sheets range when allowed.
• Use notes, reminders and founder controls.

This release does not give staff general computer control, web browsing, email sending or money-moving tools.

Private notes

A person can ask the agent to save a private note and read it back in their own private chat.

Like a personal notebook with your name on it.

• Each person has their own notes.
• Notes are saved in the company record.
• Private notes stay out of shared instructions.

Saving a preference does not guarantee the model uses it every time. Full staff profiles and searchable company knowledge are future work.

Reminders

The agent saves a job, waits for its time, checks access again, and tries to send it.

Like an alarm clock with a note attached.

• One date, a daily time, or a repeating interval.
• Staff reminders go to their own private chat.
• A founder may schedule an approved shared report.

The Mac and connection must be running. A report uses one approved data source. Sending does not prove someone read it.

Recovery

Puestario checks the agent, keeps records, and can make an encrypted recovery copy.

Like a checkup and a spare copy of your important work.

• Logs help explain what happened.
• Real checks are needed before handover.
• A restored agent starts paused, with jobs off.

The gateway must be stopped for a backup. The encrypted copy goes outside the company folder; its key stays separate. Backups are not automatically scheduled.

WhatsApp

Your message reaches OpenClaw through the linked WhatsApp account. The real sender and chat are checked.

Like the front door for your messages.

• Dedicated linked account.
• Approved private chats or groups.
• Text replies in this release.

Telegram backup and voice/media handling are not built into this release. The live phone connection still needs pilot testing.

Online AI

The online AI reads the request and instructions. It chooses what action to ask the protected tools to do.

Like a reader who understands your request and picks a tool.

• A selected model and optional fallback models.
• Messages and approved app results may go to the provider.
• The AI cannot grant itself access.

A Mac mini does not make the whole AI local. Provider use has its own costs. This kit does not enforce a combined vendor spending cap.

OpenClaw

OpenClaw runs on the Mac. Puestario plugs in its permission checks, tools and clock.

Like the engine that keeps the parts working together.

• Receives messages and calls the selected AI.
• Loads the two Puestario plugins.
• Uses a separate company profile.

Pinned OpenClaw: 2026.5.27. Codex and Claude Code are optional operator tools; they are not the running agent or its staff tools.

Version and limits

This guide documents a specific public pilot release. Installation and real-account testing are still required. Voice handling and all workflows from existing custom agents are not included in this release.