Today's business post is about an AI chatbot for website enquiries: what it should handle, and the five points where it has to hand over to a person. I wrote it from Meta's messaging policy and two Acts. This one is the other side of it. I run my own business on automation, including the assistant that drafts these posts, and it works under a short list of handover rules that I wrote one at a time, usually after it did something I did not want. They are the same five rules the business post gives a chatbot, and I did not notice that until I lined them up this morning.
The rule that fired today
The post planned for today had a different title: what people actually ask a chatbot before they ask a person. The data to write it exists. Every conversation that comes through the chat widget on my site lands in the CRM, and the assistant that drafts these posts has a key to that CRM.
It did not get to read them. The permission layer it runs under refused the request on the grounds that the conversations are personal information, and the run did not look for a way around that. It was the right call, and not for a soft reason. The people who typed into that widget gave their names and numbers to ask a question, not to become a paragraph in a blog post. Reading their messages for that purpose would have been processing for a purpose they never gave the information for, which is the exact thing the business post says a bot may not do on your behalf. The rule held on my side of the screen before I had finished writing it for yours.
So the title changed. This is the post it changed to.
The five handover rules, in the order I learned them
1. Two failed attempts, then hand me the clicks. This one is dated 16 July. I was watching the assistant fight a rich-text editor in the CRM for the third time, undoing and retrying, and I interrupted it with a sentence I have kept in its rules ever since: if you are struggling with something, tell me, so that I can click it in thirty seconds. The rule now reads that after two or three failed attempts at the same step it stops retrying variations and gives me an exact instruction, what to open, what to click, what to paste, and keeps doing the parts it is good at while I click. Every retry was costing me a minute of waiting for something that takes me half a minute by hand. That is the chatbot rule about failing twice, word for word, two months before I wrote it for a chatbot.
2. No overnight work on the live system. Three days later, in the middle of a long build, I asked it to carry on while I slept. It pushed back, and the pushback is now a rule: on any high-touch build in the live CRM, it does not accept an overnight plan, even if pressed. It writes me a spec I can execute in a focused morning instead. The reasons it gave were the reasons a bot should not be left alone with a customer: the interface fails in ways that need a human hand, security prompts fire that only I can answer, and half the decisions are judgement calls about what a client should see. I would wake up to a half-broken account. So it hands over the night, and I get a document.
3. No source, no number. Ask. Every figure that goes into a proposal has to trace to a stated rate, a template, or a signed statement of work. If none of those exist, the rule is four words long: if no source exists, ask. The assistant is not allowed to estimate its way past a gap. This is the chatbot rule about price: quote the page, or capture the scope and hand it to a person who writes the quotation. A number nobody can point to is worse than no number.
4. Unsure whether it is safe to publish, stop. Set on 6 July, for the marketing engine and everything else it produces. Nothing confidential, nothing financial, nothing about a client, and if it cannot tell whether something is safe to publish, it does not guess. It stops and asks. Today's refusal is this rule and the first one shaking hands. The tooling stopped; the run did not argue.
5. Decide for yourself, and only ask me if there is actual risk. This is the counterweight, and it is the most recent, from 31 August. A handover rule that fires on everything is not a safety feature, it is a slower human. When I approved September's content calendar I told the engine to make its own calls and to bring me only the ones with real risk in them. Since then it has substituted keywords, swapped post titles, moved posting slots around a collision, and logged every one of those decisions without asking. The four rules above define what "actual risk" means: the interface is beating it, the system is live and I am not there, a number has no source, or a fact might not be safe to publish. Everything else, it decides.
What that list is actually for
Read the business post's handover triggers again: the visitor asks for a person, the answer is a decision about them, the bot has failed twice, money or a grievance is on the table, sensitive information is offered. Now read my five. They are the same list pointed at my own operation. A person on the other side who is being made to wait. A decision that should not be made alone. A second miss. A number that has to be right. Information that was given for one purpose and must not be used for another.
None of the rules make the assistant smarter. They make it stop at the right moment, which is a different thing, and it is the thing most people leave out when they put a chatbot on a website. They spend the budget on what it can answer and nothing on the moment it should stop answering.
The part I still do by hand
Rule five depends on rules one to four being complete. If there is a kind of risk I have not written down, the engine will decide it, correctly by its own lights and wrongly by mine, and I will find out afterwards. Today it found a gap I had not written down, purpose limitation on conversation data, and the tooling underneath it caught the case before I had a rule for it. I have a rule for it now. That is how every one of the five got there, and I would rather say so than pretend the list is finished.
Chat soon.