Hired, not installed.
Write it a handbook, grant it read-only access to the things it needs, and it drafts every reply for you. Turn on automatic handling and it answers by itself — but never with an action it has not been allowed to take.
Decide how far it goes
This one dropdown decides how much of your business the agent touches. Everything else is detail.
Off — it drafts, you send
The assistant reads, looks things up and writes the reply into your panel. Nothing reaches the visitor until you press send. This is where every site starts.
Automatic handling
It answers the visitor itself. One switch, and you can flip it for the whole site or for a single conversation — and the moment you click into its composer, that conversation is yours again.
52%
of the messages your site receives land between 23:00 and 07:00 in Singapore. The agent is answering them and queueing what it cannot decide.
Two documents, on purpose.
The handbook is how to speak. The knowledge base is what is true. Keeping them apart is the difference between an agent you can correct and one you have to rewrite.
Handbook
Tone, boundaries, when to step back. Short, edited by hand, changed rarely. It should never contain a fact that could go out of date.
Knowledge base
Shipping windows, materials, warranty terms. Written as articles with categories and a draft state, so a half-finished policy is never quoted at a customer.
It sees a function name. Never your keys.
Register the endpoint once with its URL and token. The agent only ever receives the signature, calls it by name, and gets a filtered result back.
Read-only is the whole boundary. Looking things up is safe to delegate. Changing them is not, so changing them is what a human is for.
{
"name": "lookup_order",
"description": "Status of one order belonging to the current visitor",
"parameters": {
"order_no": { "type": "string" }
}
}Four failures we refused to leave to the model
It cannot act on its own
Every function you add is marked read-only or not. The ones that are not stop the assistant cold: it can propose the call, but a person has to click confirm before anything is sent to your systems. Ownership checks stay where they belong — inside your own endpoint, which is the only place that knows who owns what.
Weak answers are marked, not hidden
A reply that cites nothing it looked up, or that promises something still waiting for approval, gets flagged in the panel before anyone sends it. These are deterministic checks over the text, not a second model — they cost nothing and cannot hallucinate.
You can see what it did
Its whole working — which function it called, what came back, what it concluded — sits in a panel next to the conversation, separate from what the visitor sees. You act on it; you do not re-investigate it.
A dead endpoint is not an excuse to invent
A call that times out comes back as a failure it has to work with, not as a fact it can make up. Calls run server-side with a hard timeout and a truncated response, and outbound requests are checked against private address ranges before they are made.
Interview it before it meets a customer
The test console puts you in the visitor seat. Ask the awkward questions: the refund demand, the order number that is not theirs, the thing your policy does not cover.
Nothing reaches a real conversation. It still counts against your monthly allowance, because the model really runs — a test that does not cost what production costs is not a test.
Questions people ask at this point
Which model does it use?
One model, chosen and kept current by us. It is not a per-site setting — a support desk should not have to benchmark models to get an answer written.
Does it answer in the customer language?
It writes to the visitor in the language the visitor used. What it writes to you — its reasoning, its questions — comes back in the language your team writes in, which is usually a different one. If the visitor has not written enough to tell, it falls back to English rather than guessing.
What stops it going off script in a long conversation?
Your handbook is re-sent with every single turn rather than once at the start, so a long thread cannot push it out of the window. The checks over the outgoing text run on every reply, however old the conversation is.
Can I see what it costs me?
Plans include a monthly number of AI runs, shared across every site on the account. When it is spent the assistant stops and says so; nothing else stops.
Will it read the session recording?
Not yet. It reads the conversation, your knowledge base and whatever your own endpoints return — the recording is something a person opens, not something the assistant watches.
Give it a night and judge the morning.
Write ten lines of handbook, let it draft while you sleep, and read what it wrote over coffee.
Free plan stays free. The AI is the only thing that ever costs you anything.