Safety & Trust Rules
The rules every setup follows
AI assistants can now act, not just answer. That makes the setup matter: what it can see, what it may do on its own, and what it has to ask you first. These are the defaults I build in, in plain English.
- Drafts first. The assistant writes the email, the reply, the follow-up, the post. A person reads it and decides whether it goes out. That’s the default on every setup.
- Humans approve anything that leaves the building or moves money. No outbound customer messages, payments, refunds, or purchases without a human click. You can loosen rules for internal summaries later, on purpose, in writing.
- No passwords taken. I never ask for, write down, or store your passwords or two-factor codes. You type them yourself.
- You press the buttons. Every sign-in, every “allow,” every permission screen is yours to approve. I explain what each one means before you click.
- You own every account. Seats are bought in your business’s name, directly from the vendor, on your card. I don’t resell seats or keep admin access. If we part ways, nothing breaks.
- Least access. The assistant gets the folders, inboxes, and tools it needs for its job, and nothing else. We write down what it can reach.
- Business-tier plans where they matter. Where a vendor offers business plans with admin controls and no training on your data by default, I recommend them. We check each vendor’s current terms together; they change.
- You stay in control. You and your team approve your own work and can change your own rules. I’m not in your approval chain, and I only have access if you invite me in for support.
- Private client details stay out. No health information, and nothing that names, locates, or dates a client or patient, unless your vendor covers it under a HIPAA business associate agreement. Grok Bot setups never hold it.
- A written rules card. You leave with a one-page card listing what the assistant does alone, what waits for approval, and what’s blocked.
Data privacy basics
What to keep out, and why
- Don’t paste passwords, full card numbers, or Social Security numbers into any AI tool.
- Patient health information stays out unless you’re on a plan the vendor offers for it, and that compliance call is yours. I don’t set up workflows touching patient records otherwise.
- Some tools can see everything a person can already see (Copilot reads what you can reach in SharePoint, for example). We review sharing before turning them on.
- Your vendor’s privacy terms govern your data in their product. I’ll point you to them; read the parts that matter to you.
- This website uses no cookies, no analytics, and no trackers, and stores nothing. Forms go straight to Michael by email. See the privacy policy.
What I won’t do
Hard no’s
- Take or store your passwords
- Set an assistant to send customer messages or move money on its own by default
- Buy seats on your behalf or resell them
- Keep admin access after the job is done
- Set up workflows that handle patient records on plans not meant for it
- Pitch AI output as legal, medical, tax, or financial advice
- Promise outcomes I can’t control
- Install anything without telling you what it does
Ready to get your afternoon back?
Book a short intro call and I’ll give you a straight answer about what fits and what it costs. Not ready to talk? The two-minute Stack Finder gives you a plan on your own.