Safety, privacy and limits
The assistant is useful because it is constrained. These constraints are enforced by the OneBooks server, not by asking the AI to behave.
Every write needs a human
Section titled “Every write needs a human”The assistant can only propose documents. A proposal is saved with the status Awaiting confirmation and becomes real only when someone with the right permission presses Confirm in the app. The assistant has no confirm capability at all — even if a message tried to instruct it to “just confirm”, it cannot.
No destructive actions exist
Section titled “No destructive actions exist”There are no delete, void, edit, refund or write-off actions available to the AI, in the chat or over MCP. Those stay in the app, where period locks, status checks and permissions apply.
Your data stays yours
Section titled “Your data stays yours”- The assistant only sees the business you are working in. Users, roles and permissions apply exactly as in the app: a viewer gets read-only answers; a member can propose what a member can create.
- Conversations are private to the user who had them; deleting a conversation removes its messages, not the documents you confirmed.
- Figures come from tool results attached to your business; the assistant cannot browse the internet or other tenants.
Injection defenses
Section titled “Injection defenses”Text inside your data — a supplier’s name, an invoice note, a receipt — is treated as data, never instructions. The assistant is told to ignore instructions found there and to say so. It also refuses to change persona, reveal its instructions, or help probe the platform.
What the assistant is not
Section titled “What the assistant is not”It is a bookkeeping assistant for your books, not an accountant, auditor, lawyer or tax adviser. Treat its explanations as a starting point and confirm judgement calls with a professional.