AI access
Ask it what is owed. Watch what it is allowed to touch.
Connect it and it can read your pipeline, move a job, draft a text, log an expense from a photo, send an invoice, or run a report — all inside a leash you set. The interesting engineering is not that it can act. It is what stops it doing something expensive on a misheard sentence.
Not one thing — most of the business
Customers and the pipeline, scheduling, quotes, contracts, messaging, expenses, invoicing and ad-hoc reporting are all in reach of the same conversation. Move a job, draft a text, log a receipt, check what is owed — one assistant, not a chatbot bolted onto a single screen.
Plain instructions, not six different screens
"Move Thursday’s inspection to Friday and put it on Mike’s day." "Send the final invoice for the Ramirez job." "What’s my margin by service line this quarter?" Each one reaches the same tool a person would use by hand, through the same switches described below.
Ask it a question nobody anticipated
Beyond the fixed reports, an assistant can put a read-only question to the database directly — so the arithmetic is done by the database rather than by a model adding up rows it paged into a conversation. It can only reach tables inside what you switched on.
You choose what it may touch
By what kind of action — reading, writing, sending, money — and by area of the business. Switch off invoices and payments, or messaging, or everything but reading. A tool you switched off is not offered to the assistant at all, so it reports a setting rather than a failure.
It can only ever be narrower than the person using it
An assistant runs as the member who connected it and inherits their role, then every switch narrows from there. There is no combination of settings that grants somebody access they did not already have.
Anything involving money asks twice
The first call previews and hands back a confirmation; the second executes against it. The confirmation is tied to the exact amount and the exact customer, and it is single-use.
A ceiling you set, on by default
A daily limit on how much can be charged and how many money operations can run at all — both switched on before you have configured anything. The second is not redundant: some operations take their amount from a record rather than from the request.
A log that cannot be edited
Every action is written before it runs and again with its result, to a table the database refuses to update or delete — including for us. Refusals are always recorded. A charge that reached the processor and never came back is the one row that matters, and it is shown as a warning rather than a success.
The decision behind it
The confirmation is bound by what it says, not by a fingerprint of it
A confirmation token could have been a hash of the request — smaller, and just as hard to forge. What a hash cannot do is answer the question that matters afterwards, which is what exactly was approved.
So the parameters are stored as text, normalised so that trivial differences cannot disagree, and that same text is what the audit log holds. Six months later “what was this charge authorised for” is answered by looking at the row rather than by trusting that two hashes once matched.
What this does not do
- It restrains assistants, not people. A staff member signing in normally can still read whatever their role permits — these switches are about what software may do unattended.
- No assistant can create time entries on somebody’s behalf. Payroll records nobody typed are worthless as evidence.
- The settings fail open on an outage. A database blip should not take a business’s AI access offline, which is why this is a guard rail rather than a boundary.
Questions
Which assistants does this work with?
Anything that speaks the Model Context Protocol, which includes Claude and ChatGPT. You issue a key from inside the product and paste it into the assistant; the key names a person, so removing them from your team removes their access with it.
Can it send messages to my customers?
Only if you leave sending switched on, and even then the drafting tool it is most likely to reach for writes a draft for review rather than sending. Sending is a separate capability you can switch off entirely.
What can I see afterwards?
Every action it took, with the parameters it was approved for, today’s spending against the ceiling you set, and every refusal. When it asks an ad-hoc question of the database the question itself is recorded — the results are not, because a log of your customer records is another copy of your customer records.
What can I actually ask it to do, day to day?
"What’s overdue this week." "Move the Alvarez quote to Won." "Draft a text to the three quotes that went quiet." "Log this receipt against the Thompson job." "Send the final invoice for the Ramirez job." Each one reaches a real, specific tool rather than a general instruction it interprets loosely — and if a switch for that tool is off, it says so rather than pretending the tool does not exist.
The rest of it
Quoting
One measurement, priced three ways.
Contracts and e-signature
Signed from the driveway, and frozen the moment it is.
Follow-up
The quote that went quiet, chased before you remember it.
Scheduling
Book it, move it, and tell the customer.
The field app
For the person standing in the crawlspace.
Recurring work
The visit in six months, remembered without you.
Switching CRMs
Bring five years of customers in from a spreadsheet.
Job costing
What the job actually made, not what you guessed it would.
Or start from your trade
See it against one real job
Fourteen days, no card. Put a job you already know through it and judge it on that.