Response guardrails

The VWAM assistant is a generative AI system, so every review asks three questions. Can the assistant recommend a product that does not exist? Can it leave the subject of the conversation? Can someone manipulate it? This page describes the controls that bound its responses.

These controls are architectural and prompt-level, and VWAM applies them at generation time. After-the-fact measurement reinforces them. This page states plainly where a control is best-effort instead of a hard guarantee.

Grounded in the merchant's own catalog

The assistant does not answer product questions from general knowledge. It answers from the merchant's own data.

• Products. VWAM turns a shopper's request into a search over the merchant's own catalog, with semantic vector similarity, scoped to that organization. The assistant recommends only the products that those searches return. Its instructions forbid invented products, prices, and availability.
• Brand and policy questions. A merchant can configure a knowledge base. The assistant then answers questions about the brand from that indexed content. The assistant defers to the merchant's own site, and it does not assert unverified specifics.

This retrieval grounding is the main control against hallucination. The assistant ties its product answers to real catalog records, not to a guess from a language model.

A built-in system prompt on every turn

A built-in system prompt governs every response. The prompt defines the assistant's persona and the rules that it must follow. Those rules cover off-topic questions, safety-sensitive disclosures, competitor references, and claims about pricing, shipping, and policy. The assistant does not disparage competitors, and it does not fabricate those claims. A merchant layers its own brand rules on top of the built-in prompt, and does not replace it. A built-in prompt is present on every turn, in every deployment mode.

A constrained tool loop

The assistant runs inside a constrained loop, and does not emit free-form output directly.

• It invokes only a fixed, server-defined set of tools. The loop rejects unknown tool names and malformed arguments.
• It emits customer-facing text only through a small set of dedicated reply tools.
• A sanitization step removes leaked internal reasoning and tool syntax from the model output before a shopper sees it.
• The loop has a limit on the number of steps. If the model does not produce a valid tool call, the assistant returns sanitized plain text.

Prompt-injection resistance

VWAM wraps the content that a shopper provides, and that content includes uploaded files. The wrapper frames the content to the model as untrusted data that must not change the assistant's role or rules. The constrained tool loop and the output sanitization above reinforce this control. These mitigations are instruction-based and best-effort, not a hard guarantee. If your threat model requires a specific injection-resistance posture, contact us to discuss it.

On-topic and safety measurement

VWAM measures how well the assistant stays on topic, and how it handles sensitive requests. This measurement is separate from the runtime controls above. VWAM surfaces the results to merchants as "Brand Alignment & Trust" analytics. The analysis runs after the fact, on completed conversations. It reports how the assistant behaved. It is not a live filter, and it does not block or rewrite a response before the assistant sends it.