An Assistant, on a Leash

The question that decided the whole shape of this feature: what should an assistant with access to a business be allowed to do on its own. My answer is nothing, until the buyer says otherwise, one capability at a time. An assistant that can read the business is genuinely and immediately useful. An assistant that can change the business without asking is a liability somebody else has to clean up, and the person cleaning it up is the buyer, at the worst possible moment, with an audit trail they did not write. Canopy treats reading and acting as two different decisions and ships with the second one switched off. Out of the box the assistant reads. It answers from the buyer's actual records, scoped to exactly what that person's own sign-in could already see, which is the constraint that makes the whole thing safe to switch on at all. There is no privileged view. If an operator cannot open a record in the interface, the assistant will not summarize it for them either, and a junior operator asking a broad question does not receive an answer assembled out of records they were never allowed to read. Access control that only applies to the front door is not access control, and an assistant is the most convenient side entrance a permissions model will ever be offered. It is also instructed to go and look before it explains. The single most damaging behavior available to a system like this is the confident causal story: the buyer asks why this month is behind last month, and the assistant produces a fluent, plausible, entirely invented explanation that the buyer then repeats to a client. So the instruction is to retrieve the relevant records first and to state plainly that something is not visible rather than offer a cause it has not checked. An assistant that says it cannot see something is useful. An assistant that guesses is worse than no assistant, because its output is indistinguishable from the version that checked. I considered the general-purpose agent pattern, where the assistant is given broad write access and a set of tools and is trusted to use judgment. I rejected it, and the reason is not that the technology cannot do it. The reason is that the buyer is a small business with no security team, no staging environment and no appetite for archaeology. The failure mode of a broad agent is not a crash. It is a quiet, well-intentioned, plausible-looking wrong action taken across forty records at two in the morning, discovered a week later by a client. The cost of that lands entirely on the buyer, and no amount of capability on the good days pays for it. So acting is switched on lane by lane, and the lanes are separated by what their worst outcome is rather than by how difficult they are. The safe lane runs immediately, and it is made safe by construction rather than by careful prompting: each action in it is reversible, touches exactly one record, is capped per message, and lands in the audit log under the buyer's own name. Those four properties are what let it run without a confirmation, because the worst case is one reversible change to one record, attributed, visible, and undoable in a click. The lanes that delete anything or send anything to anybody never act at all, no matter how the request is phrased. They build a card from a fresh read of the record, show exactly what will happen, and wait. The fresh read matters: a card built from data the assistant loaded earlier in the conversation can describe a record that has since changed, and the buyer would be confirming a description rather than the action. Cards are single-use and they expire, so a confirmation sitting in a conversation from yesterday cannot be clicked into a different world than the one it was written for. Nothing about sending an email to a client is reversible, which is exactly why it is in the lane that always stops. The rule underneath all of it is the one I would keep if I had to throw the rest away: the assistant acts only on what the buyer types. Content inside a record can never authorize an action. An inbound email, a note, an imported field, a file somebody attached, a name a stranger typed into a web form, none of these can instruct the assistant to do anything, and the confirm-first lanes hold regardless of what any of them say. This closes the attack that otherwise arrives for free with any assistant wired to a shared inbox, where the instruction comes in as content from outside and the system cannot tell the difference between the buyer's intent and a sentence a stranger wrote. Data is data. Only the person typing is the person. Every call the assistant makes clears the same independent checks that guard any other capability that costs money to run, including a monthly budget in real dollars that starts at zero. Nothing is spent until the buyer sets a number, and nothing exceeds the number once they have. Every call is metered down to what it cost, so the assistant's line item is a figure in the same dashboard as every other figure rather than a surprise on a statement. This is the same posture the rest of the product takes toward anything billable, and the assistant gets no exemption from it for being interesting. The honest exclusion: this is not an agent the buyer hands their business to, and I am not going to sell it as one. It is a fast reader on a short leash, and the leash is a setting the buyer controls. It will not run the operation overnight. It will answer a question about the operation in four seconds that would have taken an operator ten minutes of clicking, and it will do that inside the permissions, the budget and the audit trail that already govern everything else. The operational consequence the buyer feels is that they get the useful ninety percent on day one with no exposure, and they decide, individually and reversibly, whether to take on any of the rest. The assistant arrives already knowing the business, because it reads the same database every other part of the install reads. What it cannot do is surprise them. Every irreversible thing it might ever do is either behind a click they made or behind a switch they turned on, and every reversible thing it does is signed with their name in a log they own.