Who holds the handle.
A robot is a tool: the most capable tool a building has ever contained. Every tool has a handle, and the question that decides whether embodied AI belongs on a floor full of people is not what the tool can do. It is who holds the handle. Our answer is built into the architecture, not written into a policy: the operator holds it, and the regulator can read it.
A wrong answer on a screen is a typo. A wrong action on a floor with people on it is an incident.
That difference is the whole product. Chat assistants could afford to be occasionally wrong; a machine that acts around technicians, patients, pickers, and residents cannot. So dependability is not a feature of Cereal. It is the thing being sold, and everything on this page is how it is manufactured.
Three ways the operator stays in control.
Room-level permissions
The operator grants sources and rooms one by one: this cold aisle, not that cage; the loading dock, never the pharmacy; the plant room, never a resident's room. Consequential actions require approval from a named person, and a revoked grant is honored by the state itself, not by a settings page.
Site-local memory
Site-owner control and local continuity are the design direction. The current robot uses cloud-connected services; data location, access, retention, deletion and export need to be agreed for the deployment and each type of record.
Fleet learning, bounded
Fleet learning is a research direction, not permission to reuse site recordings. Any sharing or learning use needs an explicit policy, an agreed purpose and access controls for the deployment.
IllustrationRoom-level permissions, enforced in code, not in a settings page.
If it fails, you hold us.
Ask the hardest question first: a robot is moving a cart across a dock, a ward, or a data hall with people in it, and something goes wrong. Who does the operator hold accountable? Not a model vendor. Not a hardware maker. Us.
A car is thirty thousand parts from hundreds of suppliers, and when it fails the customer holds one company accountable: the badge on the hood. Cereal is built the same way. One contract, one brand, one number to call at 3 AM. Bodies and motor intelligence are our supply chain; nothing runs on your floor unless it passes our dependability gate, so we answer for the outcome.
Accountability without evidence is just an apology. The design: every action on a Cereal floor is signed by the device that performed it into one continuous, tamper-evident record, so when something goes wrong we can show what the machine knew and did, verifiable by the operator, by an insurer, or by a regulator. Today our robot signs a record of each visit and each stop; replaying that record in simulation is the direction, not yet the product.
IllustrationSigned by the device that acted, replayable in simulation, readable by an insurer or a regulator.
Every skill runs supervised on your floor before it earns autonomy there, task by task, and the record of that graduation is part of what you buy. Safety is deterministic code beneath the mind; the AI never holds safety authority.
Can it see through our cameras?
The owner controls who can open a private live view and can end viewing access. A live stream, a requested photo and a stored recording are different uses, with different permissions. We agree what may be captured, who may see it, where it is stored and how long it is kept for each deployment. The current camera can see people; privacy depends on explicit controls and operating boundaries, not a promise that an AI will always recognize a private moment.
Room by room, source by source, person by person. A grant says who may perceive what, for which tasks. Revoking live access and deleting previously stored material are separate actions; the available controls and backup retention must be confirmed during setup.
A building you can ask. Where is the supply cart. Was the fire exit clear at two in the morning. Who entered the cage overnight. Which bay did the linen run skip. The queryable site is what permissioned perception makes possible, and it is useful before a robot ever touches anything.
Grants are the operator's to scope and revoke, and every access lands in the record.