Ideas
Free conversation, controlled actions
The rendering can be generative because the write is not: the guardrail is no longer a button hidden in an interface, it is a right evaluated whatever the wording
“If the rendering is generative, we lose control.”
That is the most frequent objection since the start of this series, and it deserves better than reassurance. Here is the answer, on a real write case.
The intention before the action
A purchasing manager asks to order four hundred units of a reference from a supplier.
The agent triggers nothing. It produces a readable, costed summary — supplier, reference, quantity, negotiated unit price, lead time, committed amount — and waits for an explicit gesture.
Reading is free. Writing gets confirmed. Both need clear rights.
- Profile Purchasing manager
- Spending limit €25,000
Single screen — conversational agent
Order 400 units of FIL-2210 from Novaline
System response
Here is the order I am about to place. Nothing is sent until you confirm.
- Supplier
- Novaline SAS
- Reference
- FIL-2210
- Quantity
- 400 units
- Negotiated unit price
- €13.00
- Estimated delivery
- 24 Sept
- Committed amount
- €5,200.00
The agent does not improvise a write. It produces a readable, costed and reversible intention, then waits for an explicit gesture.
This is not interface politeness. It is the principle: a write never starts from an inference. It starts from an intention made verifiable, then confirmed.
The guardrail is not in the screen
Same sentence, same agent, same data set. Another user: a warehouse operator, spending limit of two thousand euros.
The order is worth five thousand two hundred euros. The agent refuses, says why, and offers to route the request to the authorised manager.
The guardrail is not in the screen. It is in the profile.
Same sentence, same agent, same data set. Another user.
- Profile Warehouse operator
- Spending limit €2,000
Single screen — conversational agent
Order 400 units of FIL-2210 from Novaline
System response
Order not sent
The committed amount is €5,200. Your profile allows €2,000 per order.
I can prepare the request and send it to Sonia Berthier for validation. You keep control of the quantity.
The conversation is free. The actions are not. A button is no longer hidden in an interface: an action is refused at the level of the right, whatever the wording.
This is the most important architecture point of the series. In a classic application, control is often a property of the screen: the button is not rendered, so the action is not possible. It is a fragile protection, and everyone knows it — it disappears as soon as you leave the interface.
In a conversational journey, that protection can no longer exist, since there is no longer a screen to constrain. Control goes back down to where it should always have been: in the evaluation of the right, at the moment of the action, regardless of the wording.
A useful constraint, by the way. It forces what often stayed implicit in the view code to be made explicit.
The trace
There remains the question every auditor asks: if the surface is generative, what is logged?
Not a click on a button. What is logged is the intention as phrased, its resolution into parameters, the query actually executed, the control applied with its result, and the write produced.
The trace is no longer a click. It is an intention and what it produced.
- timestamp
- 2026-09-16T10:42:07+02:00
- user
- m.duval — Purchasing manager profile
- intention
- "Order 400 units of FIL-2210 from Novaline."
- resolution
- ref=FIL-2210 · fournisseur=NOVALINE · qte=400
- query
- SELECT prix_negocie, delai FROM contrat_fournisseur WHERE ref='FIL-2210' AND actif=true
- control
- limit €25,000 — amount €5,200 — authorised
- write
- commande_fournisseur #CF-20260916-0113 created
This is the real answer to the risk. The rendering is generative, but the query executed, the control applied and the write produced remain auditable line by line.
The rendering is free, but the path from intention to write is auditable line by line. To my mind, it is an improvement on what exists: a classic application log records that a user submitted a form, rarely what they were trying to get.
The real risk area
I end where I am not reassuring.
These guardrails protect writing. They do not protect reading. A business intention misinterpreted triggers no alarm: it produces a plausible figure, displayed cleanly, and the user has no way of seeing that it is wrong.
That is why the query executed must remain viewable from the rendering. The subject is not trust in the model, it is the traceability of the path. And on that, there is work left.
Next objection
The fairest of them all, and the one I have not tried to escape: nobody will validate two hundred receipts by dictating two hundred sentences.