Planvio Lets AI Modify Real Project Work Through Governed Tools

An open-source project manager built around acting AI

A developer going by hatemsweileh on dev.to has released Planvio, an open-source, self-hosted project management platform with code published on GitHub. In the announcement post, the developer argues that AI in most project management products today is limited to a side panel that summarizes, drafts or answers questions, and that the more interesting question is what happens when the AI is allowed to actually do the work: create the tasks, move the deadline, help resolve the risk.

Planvio's answer is to treat AI as an operating layer inside the application rather than a chat window beside it, subject to the same permissions, policies and audit trail as any human user.

AI runs through the application, not around it

According to the post, the AI in Planvio gets no raw database access, no hidden administrator account and no unrestricted mode. Instead, the application exposes 39 explicit AI tools, each with a defined schema, and every request they make passes the same pipeline a human action would: validation of the input, authorization checks, workspace scoping, the application action itself, a transaction, and an audit record.

The developer frames this as the core architectural decision: the model is not placed above the product but made to operate through it. A request such as creating five launch tasks therefore cannot bypass the app's rules, because there is no separate path for the AI to take.

Three modes of delegation

Planvio ships with three configurable AI behaviors. In Assistant mode, the AI can analyze real project data but makes no changes, which the developer describes as the safest starting point. In Copilot mode, it proposes actions that a person must approve before execution. In Autonomous mode, it executes actions within limits set per workspace and project, with destructive operations still requiring human sign-off and a dedicated kill switch that halts autonomous execution without shutting down the rest of the platform. The developer stresses that autonomy here is bounded by policy rather than open-ended.

Permissions and prompt injection

Two safety properties are called out in the post. First, when a user lacks permission for something, the AI is simply denied: it cannot work around the restriction by switching to an elevated service account, finding a hidden endpoint or issuing a raw query. Authorization stays in one place, which the developer says makes the AI's behavior easier to reason about.

Second, Planvio treats user-generated content — task descriptions, comments, wiki pages and imported records — as untrusted data when it is passed to the model. Because stored text could contain injected instructions, the design principle is that text inside the application should never automatically become authority over the application.

Every AI action is logged separately

The platform records AI activity apart from human activity, so the log distinguishes a status change made by a person from one made by Planvio's AI. Each AI tool call stores its arguments, result, risk level, approval state and the user whose authority was used, which means administrators can reconstruct what the agent did rather than only seeing the final state of the workspace.

A full project platform, not an AI demo

The developer emphasizes that Planvio is intended as a general-purpose business tool, not an AI experiment with a board attached. The feature list includes projects, tasks and subtasks, checklists, dependencies, milestones, custom statuses, Kanban, list, calendar and Gantt views, time tracking, budgets and expenses, reports, documentation, comments and mentions, attachments, notifications, workspaces, roles and permissions, teams, guest access, a REST API, webhooks and two-factor authentication. The target use cases are business work such as marketing campaigns, construction, events, product launches and client projects, with the AI layer sitting on top of that existing application.

Why it matters

Most AI features in project management tools remain read-only assistants. Planvio represents a different bet: agentic AI that writes to real workspaces, but gated by the application's own authorization model instead of a database connection. The design questions it tackles — how much authority to delegate, when humans must approve, how to audit agent actions, and how to stop stored text from hijacking an agent — are exactly the ones every vendor adding agents will face. Being open-source and self-hosted also lets teams inspect those controls rather than trust a vendor's claims. The obvious caveat is that this is a newly released project announced in a single blog post, so its maturity and real-world hardening remain unproven.