Seeing it
The question about an assistant in a CRM is not what it can do.
It is what it can do wrong. Delete the wrong record, email the wrong customer, move a deal somebody was negotiating, or quietly answer using data the person asking was never allowed to see.
Each of those is prevented by structure rather than by instruction.
What it cannot do
Destructive actions are refused at registration, not filtered at runtime.
A tool marked destructive cannot be registered at all — the attempt raises, with a note saying to ship an explicit confirmation flow first. So the answer to "could it delete something" is not "we filter those out"; it is that no such tool exists to be filtered.
Of the tools that do exist, three write, and all three only add: complete a task, log an activity, write a note. Nothing can move a stage, close a deal, send an email, approve anything, or move money.
And every one of them runs as you — through the same service layer the screens use, inside your own permissions. It cannot read a record you could not open yourself.
- Permission is rechecked on every call —
Not once at the start of a conversation. A permission revoked mid-session applies to the very next question.
- Three gates, in a deliberate order —
Scope, then entitlement, then permission — because the first two must hide a tool entirely. Showing it would reveal that the capability exists, or that your organisation bought a particular add-on.
- Text it writes into a note is escaped —
So an answer can never inject markup into a record.
- Charts cannot reach past the report builder —
A chart you ask for in words is built as a report — over the same short list of fields. It cannot compose a query the builder could not.
- A wrong field name comes back as suggestions —
Real field names, as things to click, rather than an error.
Answering
Citations are assembled from what was retrieved, never from the answer.
Which means a citation cannot be fabricated — it is not the model's output, it is the list of records the answer was built from.
And when nothing sufficiently relevant is found, it says so. Over call transcripts there is a deliberate floor: below it, the material is not close enough to be worth citing, and saying there is no evidence is better than producing something.
Three different empty answers, distinguished: nothing found, the model is unavailable, or the search ran in a reduced mode. A screen can tell you which, rather than showing one shrug for all three.
- It will refuse some questions outright —
Questions about protected characteristics are refused on the hiring side — in the instruction, and again in code before anything is queried, so a question that talks its way past the first is stopped by the second. Every refusal is recorded.
- It is deliberately read-mostly across the platform —
Tools exist for the CRM, customer success, hiring, finance, delivery, support, people and call evidence. The overwhelming majority read.
›Which model, and where does our data go?
Answers are generated by a language model, and what reaches it is only what your question needed — retrieved under your own permissions. We do not publish the vendor or model on this page; it is a question for a security review, where it can be answered properly and kept current.
›Can it answer about anything in the platform?
No. Coverage is broad but not total — there are areas with no tools at all, and it will tell you it cannot rather than improvising.
›Can I use it from outside the product?
The same tools are exposed so a compatible client can use them, under the same permissions and the same refusals.
›Is a conversation remembered?
Each question is answered on its own today, so include the context you need in the question rather than relying on what you asked before.