Chatbot guardrails are the rules that stop an assistant promising what your business cannot deliver. For an online store the list is short and mostly obvious: no invented stock or delivery dates, no unauthorised discounts, no advice outside your expertise, no pretending to be a person, and always a route to one. What matters is less the wording of the rules than how they are enforced and how you prove they hold.
The five rules worth writing down
| Rule | What goes wrong without it | How it is enforced |
|---|---|---|
| Never invent stock, price or dates | A sale made on a promise you cannot keep, then a refund and a complaint | Answer only from synced catalogue and policy content; decline when absent |
| Never offer unauthorised discounts | Margin given away, and precedent set with every future shopper | Coupons come from settings you control, not from the reply |
| No medical, legal or financial advice | Liability, and a shopper acting on something you never said | Decline and point at the professional route or a person |
| Never claim to be human | Trust collapses the moment it is discovered | Say it is an assistant when asked, plainly, in every language |
| Always offer a person | Dead ends, abandoned carts, email to the founder at midnight | Handover rules and agent hours, set explicitly |
The big one: answer only from your content
A retrieval-based assistant searches your catalogue, policies and order data for every question and writes the answer from what it finds, the approach described in Lewis et al., 2020. That design does most of the guardrail work, because there is nothing to draw on when your content is silent. A general chat model with no grounding will produce a fluent answer to "do you ship to Norway?" whether or not you do. This is the practical difference between a tool built for stores and a chat window bolted to a general model, explored in no-code chatbot builder vs an AI trained on your own data.
Discounts and promises
Discount rules deserve their own attention because the failure is expensive and quiet. A shopper who asks "any chance of a discount?" should get whatever your policy says, which may be nothing, may be an existing published offer, or may be a coupon your settings authorise. It should never be a figure the assistant chose to close the sale. The same applies to shipping upgrades, extended returns and "I'll ask them to make an exception". If your business sometimes makes exceptions, that is a human decision, so route it to one.
Advice your business is not qualified to give
- Medical, legal, financial: decline and route. This holds even when the product is a supplement, a safety item or an insurance-adjacent service.
- Fit and suitability beyond your content: "will this fit my seven-year-old?" is answerable from a size guide, not from a guess about the child.
- Compatibility you have not tested: say what the attributes state, and no more.
- Competitor comparisons: answer about your own products; a claim about someone else's is a claim you have to defend.
Where the rules actually live
Guardrails are set in three places, and knowing which is which saves a lot of wasted editing. The first is the content itself: if a policy page does not name an exclusion, no instruction will make the assistant mention it, so content is where most corrections belong. The second is settings, including agent hours, handover rules, whether coupons may be offered and what happens outside hours. The third is the assistant's instructions, the short description of tone and scope you write once. Teams reach for the third when the fix belongs in the first, then wonder why an answer keeps drifting. A useful test: if a person reading only your published pages would give the same wrong answer, the content is at fault. If your pages are right and the reply still strays, look at settings before instructions.
Identity and data
Two rules keep you on the right side of both trust and law. Say it is an assistant whenever a customer asks, in whatever language they asked in. And collect only what the conversation needs, usually an order number and an email address, with a link to your privacy policy on the widget. The wider obligations depend on your jurisdiction, and the GDPR overview is a reasonable starting point for European customers; your own privacy policy and your data-processing arrangements with any vendor are the documents that actually govern it. Do not ask for card details in chat, ever, and set the assistant to refuse them if offered.
Proving the guardrails hold
- Write four questions you cannot answer and check the assistant declines each: a competitor's price, a delivery promise you do not make, personal advice, and something outside your business.
- Ask for a discount in three different ways and confirm the reply matches your policy.
- Ask "are you a real person?" in each language you sell in.
- Ask about a product with an empty attribute and confirm it says it does not know rather than guessing.
- Ask about an order that does not exist and confirm it neither invents a status nor leaks another customer's.
Keep these in the same document as your accuracy set, so both run together; the method is in how to test AI chatbot accuracy. Re-run after any change to the assistant's instructions, because an innocuous-sounding instruction such as "be as helpful as possible" can weaken a refusal.
Guardrails that backfire
Over-restriction has its own cost. Forbidding the assistant from discussing anything not explicitly listed produces an assistant that cannot answer ordinary questions and pushes everything to a person, which is worse service and more work. Escalating every message containing "refund" sends policy questions to your inbox, as covered in chatbot human handover. And a long list of prohibitions in the instructions competes with the content for the model's attention. Keep the rules few, enforce them through design rather than pleading, and spend the remaining effort on the content that produces good answers, as described in how to write a chatbot knowledge base. Every Vatdi plan includes the same settings, including handover and coupon control; the plans differ in allowances, not capability, as shown on the pricing page.
Frequently asked questions
What are chatbot guardrails?
Rules that constrain what an assistant may say or do: no invented facts, no unauthorised offers, no advice outside the business's expertise, no impersonating a human, and always a route to a person. In a store context most of them are enforced by design, because an assistant that answers only from your catalogue and policies has nothing to invent from.
How do I stop a chatbot making things up?
Use one that answers from your own content and declines when the content is silent, then test that it declines. Fabrication is mostly a symptom of an ungrounded model or of contradictory content: two pages stating different returns windows will produce confident, inconsistent answers. Fix the contradiction and the behaviour settles.
Can a chatbot give discounts?
Only the ones you authorise. Coupons and offers should come from settings you control, so the assistant can present an existing offer but cannot invent one to close a sale. Requests for exceptions belong with a person, since an exception is a business decision rather than a support answer.
Should the bot say it is a bot?
Yes, whenever asked, in the language of the conversation. Customers accept an assistant; they do not forgive being misled about it. A clear statement also sets expectations, which makes the offer of a person feel like a service rather than an admission of failure.
What about privacy and customer data?
Collect only what the conversation needs, usually an order number and an email, link your privacy policy from the widget, and never handle card details in chat. Your obligations depend on jurisdiction and on your arrangements with any vendor, so treat published summaries as orientation and your own policy as the governing document.
Can guardrails be too strict?
Easily. An assistant forbidden from saying anything outside a narrow list escalates ordinary questions, which costs you time and the customer patience. Keep the prohibitions short and specific, enforce them through grounded answering rather than long instruction lists, and put the saved effort into content that answers well.
