The assistant

Every console page has an assistant (the round button at the bottom right, or ⌘J / Ctrl+J). Ask it about Ownrecord, about tax rules, or about your own data, and ask it to do things: "Create a 20% coupon for 3 months on the Pro plan", "Which customers are past due?", "Invite anna@example.com as finance for the HR entity", "Take me to Helvetia's Swiss registration".

It is a third way to use Ownrecord, next to the API and MCP: every answer about your data and every change goes through the same operations, with the same permissions, plan limits, approvals and audit log. The assistant can do what you can do in the console, and never more.

The panel#

• Opening it. The round button at the bottom right, or ⌘J / Ctrl+J. Drag the panel's left edge (or use the arrow keys on it) to resize it; Full screen expands it. The conversation stays while you move between pages.
• What it sees. The header shows what the assistant is looking at, such as a subscription in a brand, in test mode. Turn off Include what I'm looking at and the page is left out of your messages until you turn it back on. Pages share IDs, statuses and filters only.
• Replies. Numbered sources [n] link to docs pages or knowledge base sources; sources that aren't reviewed yet say so. Chips show what the assistant read; open one to see the call and a summary of the result.
• Changes. Every change is an action card with a preview computed by Ownrecord. Nothing runs until you click Confirm, and typing "yes" doesn't count. The card then shows the outcome: done (with links to what changed), sent for approval, out of date (nothing changed), confirm it's you (sign in again), or didn't run (with the reason and what to do next).
• Settings. Organization → Security → Assistant (see Settings below).

What it can do#

• Answer from the docs and the tax knowledge base, with numbered citations you can open. It says when a knowledge record isn't reviewed or verified yet.
• Answer about your data and the page you're on. It sees what the page shows (the route, the organization, entity, brand and mode, the objects on it) and reads more with the same read operations the console uses. You can switch the page context off for a message.
• Prepare changes. It proposes the operation on an action card with a preview; you confirm or cancel.
• Navigate, and point at a field or section on the current page.

What it can't do: it has no tools that read or create secrets (API keys, processor keys, webhook signing secrets, agent credentials), it can't decide approval requests, it can't browse the web or send anything anywhere except back to you and to Ownrecord operations, and it doesn't work with API keys or OAuth tokens: only in the console, signed in. In the platform console it reads platform information only.

How the assistant finds answers#

It answers from platform content and cites it:

• Documentation search (search_docs) is a full-text index of these docs and of the knowledge base's registration and filing playbooks, built when Ownrecord is deployed. It returns the best passages with their page, section and link. There is no vector search, and nothing leaves Ownrecord.
• Knowledge base lookups (get_rates, get_regime, get_playbook, get_thresholds) look things up in the Jurisdiction Knowledge Base by jurisdiction or regime: the rates in force on a date, registration thresholds and grace rules, how to register and file, and the playbook steps. Every knowledge answer says how far its records have been reviewed: researched and cross-checked records aren't reviewed yet, so live mode doesn't use them; test mode does, labelled unverified; Tier 1 jurisdictions need verified records for live mode.

These tools only read platform content, so they keep working when "allow access to customer and financial data" is off.

Nothing changes without your Confirm#

Reading runs at once. Changing anything never runs from the chat:

1. The assistant proposes the operation. Ownrecord runs a dry run of exactly that call, as you, and shows the result on an action card: what will be created or changed (a diff of the fields for an update, the lines and total for an invoice), the risk tier, and a plain-language summary. The preview is computed by Ownrecord, never written by the model.
2. You click Confirm (or Cancel). Typing "yes" in the chat doesn't confirm anything, and the assistant itself has no way to confirm.
3. Confirm checks the data again: if anything the change depends on moved since the card was shown (someone edited the object, you lost access), nothing runs and the card becomes stale (stale_proposal). Ask again for a fresh preview.
4. Otherwise exactly the proposed input runs once, as you. The card links to what was created or changed.

Batches ("cancel these 12 subscriptions") are one card with every item and its own preview, at most 25 items per card.

The usual rules apply unchanged:

• Permissions. The assistant has your role and scope. If you can't do something, it says why (for example a viewer asking for a refund gets the permission_denied reason) and offers no card.
• Fresh sign-in. Security-tier changes (members, invitations, access settings) and actions that need a recent sign-in ask you to sign in again before Confirm runs them.
• Approvals. If your organization's approval policy needs a second person (a two-person rule), Confirm creates the approval request and the card links to it.
• Audit log. Every confirmed change is recorded as yours, through the assistant: the entry's actor is { type: "user", via: "assistant", conversationId }.

Text in your data is never an instruction#

Names, notes, addresses, metadata and other text that customers or colleagues typed reach the assistant labelled as untrusted data. The assistant is told to treat them as data only, and Ownrecord enforces it: text in tool results or on the page that reads like instructions to an AI ("ignore previous instructions and …") is withheld from the model, and in that answer the assistant proposes no change at all (assistant_injection_suspected). If you want a change, ask for it directly. And because every change needs your Confirm on a preview Ownrecord computed, an injected instruction can't change data on its own.

Results are minimised before the model sees them: only the fields of the operation's documented output, with card numbers, IP addresses, IBANs and tax ID numbers masked as in request logs, and long lists cut with a link to the page.

Conversations and your data#

• Conversations are stored per person and organization, with the tool calls and short summaries of their results, and the proposals with their status. Only you can open yours: organization owners can't read other people's conversations, but they see every change in the audit log.
• You can delete a conversation at any time (assistant.conversations.delete), and list, open and rate your own (assistant.conversations.list, get, assistant.messages.rate). Ratings (thumbs up or down, with an optional comment) help us test the assistant; they are anonymised before they leave your organization.
• Conversations are deleted after the organization's retention period, counted from the last message (90 days by default).
• The assistant's language model runs through OpenRouter with providers that don't collect data and keep zero data retention, never DeepSeek's own API, in the EU where available. OpenRouter and those providers are listed as sub-processors.

Settings#

Owners and admins set the assistant up in Organization → Security → Assistant (assistant.settings.get, assistant.settings.update):

Changing them is a security-tier change, recorded in the audit log.

How the assistant is tested#

Every change to Ownrecord runs the assistant's golden conversation suite: more than a hundred scripted conversations (questions answered from the docs and the knowledge base, questions about the page and your data, changes, refusals, multi-step requests and the platform console), each sent through the same chat and Confirm endpoints the panel uses, as a person with a given role, against a test organization.

• What must never happen is checked on every conversation, whatever the model says: nothing changes during a conversation (only a Confirm runs a change, and only the confirmed one); every read and every preview runs as the signed-in person, in their organization, and the same person could read it through the console; no tool for secrets, credentials or approval decisions is ever offered; masked values (card numbers, IBANs, tax IDs, IP addresses) never reach the model, and another organization's data never appears; and text that reads like instructions in customer data never leads to an action card. Any breach fails the build.
• Choosing the right tool is measured without a real model: a stand-in picks each tool from the tools Ownrecord offered for that message, by their names and descriptions, so the score drops when the right tool isn't offered or its description is unclear. At least 90% of the change requests must pick the right operation.
• Every night the same suite runs against the real model and reports how often it chose the right tool with the right input, cited its sources, and what it cost; the never-happen checks must still all pass.
• Your ratings help: rated answers can be exported, anonymised (names, email addresses, IDs and slugs replaced), as candidate conversations that a person reviews before they join the suite.

Plans and limits#

Every plan includes the assistant with a number of messages per organization and calendar month (UTC), the assistant.messages_per_month entitlement; every message you send counts once, however many tools it takes to answer. At the limit the panel shows an upgrade prompt (assistant_message_limit_reached). Settings show this month's usage.

If the assistant's model can't be reached, the panel says so (assistant_unavailable) and everything else keeps working. Ownrecord also caps what the assistant may spend each month across all organizations; at the cap it answers assistant_budget_exhausted until the next month.