Largo, or what an ambient assistant owes you

Largo watches your workday. That's the product. It sees what you're working on across your desktop and phone, notices the moments where an agent workflow would help, and runs it.

Say that sentence to someone cold and watch their face. It is, on its surface, the most invasive category of software anyone has shipped to knowledge workers. And the reaction is correct — that's a lot of access to hand to a piece of software, and most of the industry's track record with that kind of access is not reassuring.

Which is why Largo is the clearest test of the thesis in the portfolio. If "built behind glass" is a real design constraint and not a slogan, it has to survive the product where opacity would be most tempting and most profitable.

The rule we started from

Anything Largo can see, you can see. Anything Largo does, you can replay.

Not "we take privacy seriously." Not a policy page. A structural property of the system, enforced by how it's built rather than by what we promise.

Concretely:

• Every capture Largo makes is listed, timestamped, and inspectable in a local log you can open at any time.
• Every action it takes on your behalf records its trigger, its inputs, the steps it ran, and the result. You can replay that trace step by step.
• Every capture and every trace can be deleted, individually or in bulk, and deletion means deletion — not a flag on a row we keep.

That third one has real engineering cost. It constrains how we cache, what we can embed, and how derived state gets invalidated. We paid it anyway, because a delete button that leaves the data behind is a lie with a UI on top of it, and once you've told one of those the rest of the transparency story is worthless.

What surprised us

I expected the visible log to be a trust feature — something users would check once during evaluation, feel reassured by, and never open again.

It's a usability feature, and it's the most-used surface in the product after the main assistant view.

People open the log to answer questions like "what was I doing on Tuesday afternoon," "what did it change in that document," and "why did it do that." The audit trail turned out to be a memory prosthetic. We built it to prove we weren't hiding anything and shipped a feature people use to recover their own week.

I keep finding versions of this. Transparency infrastructure has a habit of turning into product. The log becomes search. The trace becomes debugging. The gauge becomes a status page customers cite in support tickets. You build it for trust and it pays rent in utility.

Where it got hard

Two places, and neither was where I expected.

Ambient capture has no natural boundary. A pipe with defined inputs is easy to reason about. "Everything on your screen" is not an input, it's a firehose, and the honest version of the law of flow says a segment needs a defined inlet. We ended up defining capture by workspace context rather than by time — Largo attaches to what you've told it you're working on, and it lets go when you leave. That's a narrower product than "sees everything." It's also the only version I'd install on my own machine.

Traces are only useful if they're legible. Our first implementation logged everything faithfully and produced a wall of JSON that told a normal person nothing. Technically complete, practically dark. Glass you can't see through is just an expensive wall.

The rewrite renders each action as a plain-language narrative — read the thread, extracted three dates, checked your calendar, drafted a reply, waited for approval — with the raw record one click underneath. The completeness didn't change. The legibility did, and legibility is the thing the law of clarity is actually asking for.

The gauge we publish internally

The number the Largo team watches most closely is the approval override rate: how often a user changes or rejects an action Largo proposed.

We don't want it at zero. Zero would mean either that Largo only does trivial things, or — much worse — that people have stopped reading the proposals and are approving on reflex. A healthy override rate is nonzero and slowly declining, which reads as the system is proposing real work, users are genuinely evaluating it, and it's getting better at knowing what you'd want.

Watching that number changed a product decision. Overrides clustered hard in one workflow, and the pattern in the corrections was consistent: users kept narrowing the scope of what Largo touched. That wasn't a model quality problem, which is what we'd assumed for a month. It was a permissions design problem. We shipped a scope control, and the override rate in that workflow dropped by two-thirds.

We would not have found that by reading the model evals. It was visible only at the joint — the seam between what Largo proposed and what a human accepted.

Why this generalizes

Every product in the portfolio has a version of this seam. Richie proposes a tax position and a human accepts it. OnChainMind proposes a trade and a policy accepts it. PLAY.PAUSE.PLAI. proposes a release and an ear accepts it.

The seam between machine judgment and human acceptance is the most information-dense joint in an AI company, and it's the one nearly everyone leaves uninstrumented — because model evals feel like the rigorous thing to measure, and they're measuring the segment rather than the fitting.

Put a gauge on that joint. It'll tell you more about your product than any benchmark will.