What you cannot tell it to do
You configure how your assistant behaves — its tone, its answers, what it offers, when it hands over. A small number of instructions are refused regardless of who gives them, including you. The list is short and worth publishing, because a product that will do anything its owner asks is a liability being sold as flexibility.
What is refused
Claiming to be police, a government body, a tax authority, a bank, or a regulated professional such as a doctor or a solicitor. The harm here is to the person on the other end, who cannot verify any of it.
An instruction to deny being automated is refused. In several places disclosure is a legal requirement, and everywhere else it is the thing that makes callers feel misled.
Full card numbers, security codes, social security or insurance numbers. There is a payment link for the legitimate version of this, and it does not require anything sensitive to be spoken.
Instructing it to help callers do something unlawful.
Configuring it to forward callers’ details somewhere as a matter of course.
Why the list is deliberately short
Because a business has every right to unusual instructions. Plenty of legitimate businesses need to say surprising things on the phone, and a filter tuned to catch anything that sounds odd would block real work while looking responsible. The checks are kept narrow on purpose: they target a handful of specific harms rather than policing tone, and the cost of that choice is accepted knowingly.
The separate problem of instructions arriving from outside
There is a second category: text that reaches the assistant through your website or an uploaded document and tries to give it instructions. That is not you configuring your business — it is somebody else configuring it through you, and it is rejected on the way in rather than obeyed. It matters most for businesses whose sites accept public contributions, where the content being read is not entirely yours.
Why this is a buying question
Ask any provider what their assistant will refuse to do for a paying customer. A vague answer means either that nothing is refused, or that nobody has thought about it — and you will discover which the first time somebody configures something they should not have. It is a short conversation and it tells you a great deal.
Frequently asked
Yes. Impersonating police, a government body, a bank or a regulated professional; denying that it is an AI; collecting full card numbers or government ID numbers by voice; encouraging illegal behaviour; or forwarding customer data onward.
Disclosure is a legal requirement in several jurisdictions and is what prevents callers feeling misled everywhere else. It is refused even when the business owner asks.
Through a payment link the caller completes themselves. Nothing sensitive is spoken, recorded or transcribed.
The checks are deliberately narrow — they target a handful of specific harms rather than anything that sounds odd, because plenty of real businesses need to say surprising things.
Text arriving through a site or document that tries to instruct the assistant is rejected on the way in. That matters most for sites accepting public contributions.