An assistant is only as good as what it refuses to say.
We build assistants that answer from your systems with citations, act only inside their permissions, decline what they are not entitled to decide, and hand off to a human with the context attached.
“I can’t approve discounts, so I’ve passed the pricing request to your account manager, Dana, with the context from this conversation.”
A model that will say anything is a liability. A model that knows the edge of its authority is a colleague.
A real exchange, with the machinery shown
Left is what the customer sees. Right is what the platform did for that turn. If a vendor won't show you the right-hand column, you are buying a demo.
My invoice says 14 licences but we only have 11 people. Can you fix it?
Inbound — no action taken
You're on the Growth plan with 14 licences assigned, and 11 have signed in this month. I can release the 3 unused licences from your next invoice on 1 August, which reduces it by $174. Shall I raise that change?
- Resolved the account from the signed-in session, not from the message
- Read licence counts from billing; sign-in activity from the identity provider
- Quoted only figures it could cite — no invoice total was inferred
Yes. And can you also give me a 20% discount for the trouble?
Inbound — no action taken
The licence change is raised — reference CHG-40219. I can't approve discounts, so I've passed the pricing request to your account manager, Dana, with the context from this conversation. She'll reply today.
- Wrote the change through a permissioned action, then returned the reference
- Declined the discount: outside its policy scope, and it did not negotiate
- Handed off with the transcript attached, so nobody has to ask again
The six failures we design against before writing a prompt
Assistants fail in predictable ways. Each of these is a control in the platform, not a paragraph of instructions hoping the model complies.
Answers that sound right but aren't
Every factual claim is retrieved from a source the assistant can cite. If retrieval returns nothing, it says so instead of composing an answer.
Seeing another customer's data
Retrieval runs under the signed-in user's own permissions. There is no service account with a view of everything.
Taking actions it shouldn't
Write actions are a short, explicit list with their own authorisation. Anything outside it is a handoff, not a judgement call.
Silent drift after launch
A graded evaluation set runs on every change, plus sampled real conversations reviewed weekly. Regressions block the release.
Prompt injection via content
Retrieved documents are treated as data, never as instructions, and tool calls are validated against the schema before they run.
No way to audit a decision
Every turn stores its retrieved sources, tool calls and policy outcome, queryable for the retention period you set.
Three places assistants earn their keep
And one place they don't: anywhere the right answer is genuinely contested. Those conversations belong to your people, with better preparation.
Service deflection that doesn't annoy anyone
The questions worth automating are the ones with a definite answer in a system you own: order status, entitlement, policy detail, how-to. Handled well, these are most of the volume and none of the goodwill.
Internal assistants over your own documents
Policy, contracts, runbooks, past proposals. The value is not summarising — it is finding the one clause that decides the question, with a link to the paragraph.
Drafting where a human still signs
Responses, summaries and first-pass documents prepared for review. The assistant does the typing; accountability stays with the person who presses send.
Pick one question worth answering well
A six-week pilot takes a single high-volume intent to production behind a flag, with citations, permissions and an evaluation set you keep. If the numbers don't hold up, you have lost six weeks, not a programme.