The jewelry connection we run in production has never written a byte. It still doesn’t. That is not a limitation we are working around — it is the design, and it is the part customers ask about first.
What “read-only” means at the wire
The point of sale in that store runs on the shop’s own machine. We never connect an AI to it. Once a night, a little after seven in the morning, Eastern, a read-only export runs over a private link into a store we control. The export has run every night since go-live; the gap between runs is zero days. The AI, and the app, only ever see that copy. The POS is not exposed to either.
On the AI side there is one MCP gateway. Behind it, at that deployment, are seventeen tools. All seventeen are reads. There is a free-form query tool for the questions nobody anticipated, and it is forced read-only at the server, with a timeout and a row cap, so a clever question cannot become a slow one or a destructive one.
Who sees what
Read-only is only half of access. The other half is who. That deployment runs three permission tiers — owner, manager, associate — and each person’s AI carries that person’s key. An associate’s assistant has a shorter list of tools than the owner’s; it isn’t refused the others, they simply aren’t there.
The part we are proudest of is quieter. The owner can designate topics that lower tiers must not reach. Those topics are filtered out before matching — a question about them never gets far enough to be answered and declined. Nothing to argue with, nothing to leak in the phrasing of a refusal.
Why this order
Three reasons, in the order we learned them.
Trust is asymmetric. A read that returns the wrong number costs an hour. A write that lands in the wrong place costs a customer. We want the first month to be spent finding out where the data is wrong — and it is always wrong somewhere — with nothing at stake but a conversation.
Read-only is where the value is anyway. The questions owners bring us are “which repairs are past their promised date?”, “who hasn’t heard from us in thirty days?”, “what did we sell them last time?” — all reads. Nobody’s first question is “please change something.”
Writing is a decision the business makes, not a switch we flip. We do run writes. In recruiting, the assistant we run creates candidates, adds notes, and advances interview stages, from the recruiter’s own Claude or ChatGPT. The business asked for those writes, and got those writes. The jewelry store hasn’t asked, and so its connection is still read-only, and will be until the day the owner says otherwise.
What we don’t claim
We don’t publish a seat count, because the number of licenses and the number of people actually asking questions are different numbers and only one of them is interesting. We don’t quote response times, because we haven’t measured them end to end yet. And we don’t describe the recruiting stage rules as a security control, because they aren’t one — they are guardrails on the assistant, not on the people.
Last verified against the running systems: August 27, 2026.
