Can I trust AI with my business? What to check first

Rolling outDay-Zero Study: running on our own companies now. Opening to new accounts soon.

You can already picture the upside. The inbox answered. The transactions filed. The repeated work gone from your afternoon. You have not connected anything, because the downside has your name on it. A wrong refund, a wrong category, a sentence to a customer you would never say. “Can I trust AI with my business?” isn’t a question about mood. It is a sequence question. Trust that skips the sequence is just access.

The instinct to hesitate is the right instinct. A tool that writes a decent paragraph is not a tool you hand a bank feed, a customer list, or an ad budget. The gap is not cleverness. The gap is whether the product will show its work, stop when it is unsure, and leave a trail you can undo.

What follows is the order we think any owner should require, the questions to put to a vendor before a login exists, and the places a person still has to stand.

1. ReadRead-only first. It watches before it acts.
2. AskOne card, one reason, how sure, what it cost.
3. ApproveYou approve the exact action.
4. RememberYour answer becomes a dated lesson.

Read before it can change anything

The first week of a careful new person is watching. They do not recode the books or answer the queue in their own voice on the first morning. They read how you already do it.

An AI role should start the same way. Connections start read-only. You confirm what this role may see. The bookkeeper sees the books. Customer service sees the help desk. They do not see each other’s private channels unless you explicitly allow it. Private help-desk notes should never reach the model at all.

Then it reads history. How you categorized vendors. How you answered the same questions. What you refund and what you refuse. That read is the training that does not depend on you writing a novel in a prompt box. Nothing about a read-only pass can move money or send mail. That is the point. If a product’s first step is “grant full access,” you are allowed to close the tab.

Ask, then wait for a specific yes

The damaging failure is not a visible mistake. It is a quiet one. A category applied in silence. A tracking promise sent while you were in a meeting. You cannot correct what you were never shown.

So the second rule is: when it is not sure, it asks, and the ask is small. One card. One recommended action. One reason tied to your history or the record it looked up. How sure it is. What the card cost to prepare, in dollars, not in a bundle of credits you have to translate.

You approve the exact action. “Looks fine, go be helpful” is not an approval. The card should say what will change in the real tool: this category on this transaction, this reply in this thread. Then the role does that thing in your books or your help desk. It does not hand you a to-do and call the work finished.

Some actions get a second look even after you liked the card. Anything that moves money. Anything sent to a customer. Anything you cannot undo. That is not friction for show. It is the pause a careful operator already uses when the cost of a miss is higher than the cost of one more click.

If the card is wrong, fix it with words. Say what to change. Let the role rewrite. Correcting by doing the task yourself trains nothing and saves nothing.

Remember, and only then talk about autonomy

Every answer you give should become a lesson with a date. The next similar case should cite it. When your policy changes, the newer lesson wins, and the old one stays on file so you can see the history of your own decisions. One private memory per company, shared by the roles you run there, invisible to every other company.

This is where time actually comes back. Early on you answer. Later, the same questions do not return. If you keep answering the same thing, you should be able to say “always do this” and see that standing decision, and switch it off. Where your books system has its own rules, the rule belongs there. Everywhere else, it belongs in the memory you can read.

Autonomy comes last, and not as a master switch. The sensible version watches rework: how often you had to change the role’s work. When one kind of task has gone a long stretch with no corrections, the product may offer to let that one kind run. You switch it on. Every action stays logged. The moment you correct it, it pauses and returns to asking. Messages and money keep their extra review anyway. If a vendor leads with “set it and forget the company,” they have skipped the evidence.

That narrow autonomy is coming soon, not a claim to make about today. Today the trustworthy default is still a card and a person.

Diagram

Questions to ask any vendor

Ask these before you connect a tool you would be afraid to break. Write down the answers.

1. Does the connection start read-only? What, exactly, can this role see?
2. What can it change, and is every change tied to a card I approved?
3. When it is unsure, does it ask, or does it guess in place?
4. Can I see sources, how sure it is, and the dollar cost of the task?
5. Are my data used to train a model? What are the retention settings?
6. Can another customer, or another of my own companies, see this memory?
7. Who at your company can open my tickets, books, or files?
8. Are card numbers, Social Security numbers, and passwords stripped out?
9. Can I read, change, and download the memory myself?
10. What is the undo? What happens if the action cannot be undone?
11. What does a mistake cost me, and who notices it first?
12. If something runs on its own, what record of zero rework did it need, and does my correction pause it?

“Enterprise grade” is not an answer to any of those. Neither is a policy page you are not allowed to question. If the vendor cannot explain undo and retention in a few plain sentences, they are not ready for the connection.

Ask in writing

What can it see?

Read-only first, and only the tools you confirm for that role.

What can it change?

Only what a card you approved says. Money, customer messages and no-undo steps get a second confirm.

Where does my data go?

Ask about training and retention. Allmata uses no-training and zero-retention settings where the provider supports them.

What if it is wrong?

Ask what the undo is, and who notices a mistake first.

A trust conversation that will not discuss price is also incomplete. You should see what each task cost in dollars. A pool of credits hides the moment a workflow became expensive. Visible cost is part of consent. You are agreeing to the action and to the spend.

What still needs a person

No order of operations removes judgment. Tax positions, trusts, and anything a preparer should sign stay with your accountant or tax preparer. Allmata gives no tax advice, and neither should a chatbot with your ledger in reach.

A person still owns relationships that can go wrong in words: an angry wholesale account, a safety complaint, a promise that touches money in a way your policy has not named. The role can gather the order, the ticket history, and a draft. You decide what gets said. Some things must never be said at all. A memory helps only if those bans are explicit.

A person still owns the first version of a policy. If your past answers contradict each other, software that learns from them will learn the contradiction. Trusting it to “pick a side” quietly is how you get a new policy you did not choose. Decide, then let the lesson stick.

How Allmata does it

Allmata is an AI team for owners. Two roles are live today: Customer Service and Bookkeeper. Other roles are not a reason to pretend the trust rules change. The rules above are the product.

Connections start read-only. Nothing changes in your tools without your OK on a card that says what will happen and what it costs. Lessons are dated in one Brain per company. You can read, change, and download it. Model calls that work with your business data go through one gateway with no-training and zero-retention settings, where the provider supports them. Your data is never used to train anyone’s model. One company’s Brain never reaches another.

The Day-Zero Study is rolling out. Once it’s on for you, before an agent talks to you, it reads your history and writes how the company runs. You confirm or correct that briefing. A readiness exam on your own past answers, before live work, is rolling out too. Read about it on the Day-Zero Study page, the posture on security, and the narrative version on Read-only first.

What Allmata will not do: it will not guess a tax position, it will not send private help-desk notes into the model, and it will not treat autonomy as the opening offer. Narrow autonomy, one kind of task at a time, is coming soon, and a correction pauses it.

Where to start

Do not start by connecting every tool you own. Start by listing the actions you would hate to see done wrong. Put read-only in front of those. Ask the vendor the questions above in writing. Trust is the stack of answers, checked against a week of real cards.

If you want a calm look at what could move this week before you grant anything, use the free AI Workforce Blueprint. When you are ready to test the sequence on your own company, the 14-day trial includes $10 of AI work on us, with no card required. Plans start at $79 a month.

How the memory gets built, without you doing all the training by hand, is the companion piece: how to train AI on my business data.