How much freedom should the assistant have?
Letting people ask in their own words against only sending them somewhere real.
Context
The assistant needs to send people to places in the product — start a plumbing request, look at a pro, open a job. A model asked for a path will produce one that looks entirely correct and does not exist. It will cheerfully invent /services/cleaner and hand the customer a 404, in the middle of the moment where they were about to become a customer.
What was on the table
Let the model produce paths and validate them on the way out.
Validation catches a bad path but has nothing to offer in its place, so the failure just moves later in the turn.
Remove navigation from the assistant entirely.
Costs the one thing conversation is genuinely better at: getting someone to the right place without making them read a menu.
- Chosen
A closed set of destination ids the application resolves.
The decision
The model picks an id from a fixed enumeration. The application resolves the id to a real path, checks whether the visitor is allowed there, and accounts for the pre-launch gate before promising anything. An unrecognised id resolves to null and the client refuses to navigate. The service destinations are generated from the same service list the router uses, so the set cannot drift away from the real routes.
The principleThe AI figures out where you want to go. The app decides whether you can.
What it cost
Every new destination is a code change rather than a prompt change, and the enumeration has to stay small enough for the model to choose well. That is a real ceiling on how much of the product the assistant can reach.
Evidence
- Destinations are seeded from the shared service list, so a new service is routable without hand-editing.
- Each destination declares whether it needs authentication and whether the pre-launch gate diverts signed-out visitors.
- Unknown ids resolve to null — the refusal is structural, not a string check.
Enforced in the product code, not only described here.
What would change my mind
If the assistant's reach becomes the binding constraint on how useful it is, the answer is probably a generated manifest of real routes rather than a hand-kept list — same guarantee, less friction. What would not change is that the model never emits a path.