Who holds the handle.
A robot is a tool: the most capable tool a building has ever contained. Every tool has a handle, and the question that decides whether embodied AI belongs on a floor full of people is not what the tool can do. It is who holds the handle. Our answer is built into the architecture, not written into a policy: the operator holds it, and the regulator can read it.
A wrong answer on a screen is a typo. A wrong action on a floor with people on it is an incident.
That difference is the whole product. Chat assistants could afford to be occasionally wrong; a machine that acts around technicians, patients, pickers, and residents cannot. So dependability is not a feature of Cereal. It is the thing being sold, and everything on this page is how it is manufactured.
Three ways the operator stays in control.
Room-level permissions
The operator grants sources and rooms one by one: this cold aisle, not that cage; the loading dock, never the pharmacy; the plant room, never a resident's room. Consequential actions require approval from a named person, and a revoked grant is honored by the state itself, not by a settings page.
Site-local memory
The site record lives with the operator, not on a manufacturer's cloud. Memory is inspectable, editable, deletable, and portable across bodies. Raw site data stays on site.
Fleet learning, bounded
The fleet improves the fleet without the building's data leaving the building. What travels is de-identified patterns: a better grasp, a safer approach. Never your rooms, your people, or your schedules.
ConceptRoom-level permissions, enforced in code, not in a settings page.
If it fails, you hold us.
Ask the hardest question first: a robot is moving a cart across a dock, a ward, or a data hall with people in it, and something goes wrong. Who does the operator hold accountable? Not a model vendor. Not a hardware maker. Us.
A car is thirty thousand parts from hundreds of suppliers, and when it fails the customer holds one company accountable: the badge on the hood. Cereal is built the same way. One contract, one brand, one number to call at 3 AM. Bodies and motor intelligence are our supply chain; nothing runs on your floor unless it passes our dependability gate, so we answer for the outcome.
Accountability without evidence is just an apology. On a Cereal floor, every perception, decision, and action is signed by the device that performed it into one continuous, tamper-evident record that can be replayed in simulation. When something goes wrong, we can show exactly what the machine knew and did, verifiable by the operator, by an insurer, or by a regulator.
ConceptSigned by the device that acted, replayable in simulation, readable by an insurer or a regulator.
Every skill runs supervised on your floor before it earns autonomy there, task by task, and the record of that graduation is part of what you buy. Safety is deterministic code beneath the mind; the AI never holds safety authority.
Can it see through our cameras?
No one sees through them by default. If the operator grants a camera to the site mind, that grant is theirs to scope and theirs to revoke, and every access it permits lands in the attested record, so surveillance is impossible to do silently, by architecture rather than by promise. The presence layer watches pose skeletons, not stored video. It notices and notifies; it never records a person.
Room by room, source by source, person by person. A grant says who may perceive what, for which tasks. Revoke it and the state honors it everywhere, including memory already written.
A building you can ask. Where is the supply cart. Was the fire exit clear at two in the morning. Who entered the cage overnight. Which bay did the linen run skip. The queryable site is what permissioned perception makes possible, and it is useful before a robot ever touches anything.
Grants are the operator's to scope and revoke, and every access lands in the record.