Define capabilities instead of relying on a label
“Chatbot” and “AI assistant” are used inconsistently. A better specification describes what the system can read, what it can change and which actions require approval.
A question-answer interface may only return information. A workflow assistant may draft records or invoke tools. A rules-based bot may perform a narrow transaction more predictably than either. The visible chat bubble does not tell you which architecture is behind it.
Write an authority table
| Capability | Example | Required boundary |
|---|---|---|
| Explain | Summarise a published service | Approved factual source |
| Collect | Ask for missing brief details | Validation and consent context |
| Suggest | Propose lead classification | Clear distinction from a confirmed decision |
| Prepare | Draft a CRM update | Reviewable proposed changes |
| Execute | Save an approved action | Server authorisation, idempotency and history |
An assistant must not gain broader permissions because a user asks persuasively. Authenticate the caller and validate the action outside the language model. Restrict each tool to the minimum data and operation it needs.
Design the failure conversation
When the model cannot answer, offer a useful next step: clarify the request, open the brief or contact the team. Keep direct contact links available even when the AI provider is down. Preserve a draft where appropriate rather than pretending a failed tool call succeeded.
Avoid suggesting that a reply is human unless a person actually sent it. Make it clear when output is a draft or preliminary interpretation.
Evaluate the complete task
Test whether the system gives the right answer and whether the permitted action is recorded correctly. Include unsupported requests, prompt injection, repeated submissions and provider failure. A convincing conversation without durable completion is not a working assistant.
Explore AI automation and API integrations as separate scopes: understanding a request and safely executing it need different controls.
A practical question
Does giving an assistant tools make it autonomous?
No. Tool access must specify the authenticated actor, permitted objects, allowed operations and approval requirements. Validate each action on the server even when the model produces plausible arguments.