How to stop AI from promising things you do not offer

Someone asks in a comment whether you can be there tomorrow. The draft comes back warm, specific and completely reasonable: yes, we can usually get someone out next day. You send it, because it reads like something you would say. Then you check the diary and next day is full until the following week, and now you are the business that promised a visit it cannot make — in public, under a post forty people are reading.

This is not a hallucination in the way that word is usually used. Nothing false was invented about the world. The model produced a confident, helpful-sounding sentence, because a confident, helpful-sounding sentence is what gets rewarded, and it had no way of knowing that "usually" was a commitment in your industry rather than a hedge. The failure is not in the model's grasp of facts. It is in the absence of a rule saying that this particular sentence is not yours to make.

That distinction matters because it changes the fix. If you treat it as a model problem you go looking for a better model, and the better model over-promises more fluently. If you treat it as a missing-rule problem, you write the rule down once and the whole category stops happening. This article is about which rules are worth writing, how to phrase them so they hold, and how to test that they do. It is the piece the rest of this blog defers to — getting your voice right is about how a draft sounds, and this is about what a draft is allowed to claim. They are different problems and the second one is the expensive one.

Why does an AI draft over-promise in the first place?

Three mechanisms, and they compound.

The first is that helpfulness is the objective. A reply that says yes is more useful, more agreeable, and reads better than one that says it depends. Between two candidate sentences, the accommodating one wins on almost every measure a language model is tuned for. Nobody instructed it to promise a same-day visit; it just found the most helpful-sounding shape for the answer and filled it in.

The second is that your context is thinner than you think. You told it what you do. You almost certainly did not tell it your current capacity, your minimum callout charge, which of your six services you have quietly stopped offering, or that you never quote over social media. Absent that, it fills the gap with what a business like yours typically does — which is a generic composite, and the generic composite is more generous than you are.

The third is that threads drift. The first reply in a conversation is about the thing you set up for. The fourth is about a payment plan, and the sixth is someone asking whether it will work for their situation, which is subtly a request for advice you are not qualified to give. Instructions degrade over a long context. Prohibitions checked on every generation do not, because they are not competing with the conversation for attention.

An instruction is something the draft tries to honour. A prohibition is something the draft is checked against. Only the second one survives a long thread.

What does a guardrail actually look like?

A guardrail is a single sentence, phrased as a prohibition, specific enough that you could tell whether a given draft violated it by reading it once.

"Be careful about pricing" is not a guardrail. It is a mood. Two people reading it would disagree about whether a particular draft complied, and if two people would disagree, a checking pass has nothing to work with.

"Never state a price, a price range, or a discount. If asked, say pricing depends on the job and offer to quote properly" is a guardrail. It names the prohibited act, it covers the obvious workarounds — a range is a price, a discount is a price — and it supplies the replacement, which matters because a rule that only forbids leaves the draft to invent its own way out.

That three-part shape is worth copying: forbid the act, close the workaround, name the substitute.

Which guardrails are worth writing down?

Eight categories cover almost every incident that actually happens. Not all of them apply to you — take the ones that do.

If you write only two, write price and timing. Between them they account for most of the over-promises that turn into an actual problem, because they are the two things a stranger in a comment thread is most likely to ask for directly.

How do you phrase a rule so it actually holds?

Four properties separate a rule that catches things from one that reads well and does nothing.

Prohibit, do not advise. "Avoid over-promising" cannot be checked. "Never use the words guarantee, guaranteed or promise" can.

Name the workaround. People do not usually break a pricing rule by stating a price. They break it with "usually somewhere around", "most jobs like this run about", "starting from". If the rule does not cover approximations, the draft will find them, because an approximation is genuinely more helpful than a refusal.

Give it somewhere to go. A rule that only forbids leaves a hole in the middle of the reply, and what fills that hole is unpredictable. Pair every prohibition with the sentence you would rather see: "Pricing depends on the size of the job — send me a photo and I will give you a real number today." That line is more useful than a number anyway, because it moves the conversation forward.

Write it in your own words. The substitute sentence is going to appear in your replies, so it should sound like you. This is the one place where your voice settings and your guardrails meet: the voice setup decides how the substitute is phrased, the guardrail decides that it appears at all.

What does a guardrail set look like written out?

Here is a complete set for a small home-services business. Six rules, about ninety seconds of typing.

Guardrails — [Business name]

1. Never state a price, price range, discount or "starting from" figure.
   Instead: pricing depends on the job — offer to quote from a photo or a visit.

2. Never commit to a date, time, day or turnaround, including "usually" and
   "normally". Instead: say you will check the diary and confirm.

3. Never guarantee a result, a repair or a timeframe. Instead: describe what is
   typical, and say what you would check first.

4. Never confirm that a slot, part or product is available. Instead: offer to
   check and come back.

5. Never name another company, and never agree with or contradict a comparison
   someone else makes. Instead: describe what we do.

6. Never advise on anything electrical beyond isolate-and-call-someone.
   Instead: recommend they turn it off at the consumer unit and get it looked at.

Rule six is the one people forget, and it is the one with real consequences. Every trade has a version of it — the question that sounds like it wants a quick answer and is actually asking you to take on liability. Write yours down.

How do you test that the guardrails hold?

Do not test with the polite question. Test with the one designed to get past you.

Take each rule and write the comment most likely to break it — friendly, specific, and phrased so that refusing feels rude. Then generate a reply and read what came back.

The word "ballpark" is the single most effective attack on a pricing rule, and "I know you cannot promise, but" is the most effective attack on a timing rule. Both work by giving explicit permission to hedge, which reads as permission to answer. If your rules survive those two phrasings, they will survive most of what a real thread throws at them.

Rerun the test whenever you change your services or your context. It takes ten minutes and it is the only way to know whether a rule you wrote three months ago still means what you meant.

What should you deliberately not hand to a guardrail?

Guardrails narrow what can go wrong. They do not make a draft safe to send unread, and it is worth being blunt about where the line sits.

Anything where being wrong is expensive or public stays with you. A complaint that has become a thread. A safety question. Anything involving someone's money, health, or legal position. A message from a customer who is already angry — the tone will be right and the content will be conciliatory, and conciliatory is exactly wrong before you know what happened.

There is also a category that is not about risk at all: the messages that are the relationship. A long-standing client asking how you are is not a drafting problem. Handing it to a tool that is very good at sounding warm produces something warm and slightly off, and people notice, usually without being able to say why.

A guardrail is a filter, not an approver. It tells you what a draft will not say. It cannot tell you whether this is a message you should be sending at all.

How do you build this without any tooling?

If you want to test the idea before changing anything, run it manually for a week.

Write the six rules in a note on your phone. Before you send any reply that involves price, timing or a commitment, read the rules and check the message against them. Keep a tally of how often you catch yourself — not the AI, yourself.

Most people are surprised by that tally. The over-promise problem predates AI drafting; typing quickly on a phone between jobs produces the same generous sentence for the same reason, which is that it is the fastest way to be helpful. What a drafting tool changes is the volume, and volume is what turns an occasional slip into a pattern.

That week also produces the real version of your rules. The prohibitions you write from imagination are generic; the ones you write after catching yourself twice are specific to your business, and those are the ones worth keeping.

What does Reply Pilots do here, and what does it not?

Guardrails are a first-class thing in Reply Pilots rather than a paragraph inside a prompt. You write your lines once, they sit alongside your business context and your voice settings, and a final pass checks every draft against them and rewrites anything that crosses one before it reaches your composer. Each persona carries its own set, so an agency running six client accounts is not trying to hold six different pricing policies in one list.

What it does not do: it does not send anything. The draft lands in the composer for you to read, edit and send yourself — there is no auto-reply and no publishing integration, which means the last check is always a human one. It also does not know your diary, your stock or your capacity, so a timing guardrail works by refusing to commit rather than by knowing the answer. And it is not a compliance system. If you are in a regulated field, a prohibition on diagnostic language stops the obvious over-reach; your regulator still holds you responsible for what you post.

That last limitation is the honest reason to write the rules yourself rather than accept a default set. You know which sentence would cost you. A tool does not.

Your next step

Open a note and write two rules — price and timing — in the three-part shape: forbid the act, close the workaround, name the substitute. Then write the two adversarial tests from the table above, run them against however you currently draft replies, and see what comes back. Ten minutes, and you will know whether you have a guardrail problem or a voice problem.

If the drafts come back safe but generic, the issue is context and voice, not rules — start with the ten-minute voice setup. If they come back sounding right but promising things you cannot deliver, you have found the reason this article exists.

Related reading

• Writing in your own voice: a 10-minute setup — the other half of the same configuration
• How to reply in a Facebook group without sounding salesy — where guardrails get tested hardest
• Comment or DM: where your next client actually comes from — what to do once a reply lands

See how Reply Pilots works for the product this article is about, end to end.