Behind a deployed assistant sits a document specifying what it may and may not tell a customer. Writing that document is where most of the deployment work happens.
The starting point is existing agent guidance
Support organizations already have scripts, approved language and escalation rules for human agents, developed over years and shaped by past incidents.
The assistant's rules are usually derived from those, because the company has already decided what may be said and the reasoning is documented.
What does not transfer is judgment. An agent given a guideline applies it sensibly to a novel situation, and that adaptation has to be replaced with explicit instruction.
Prohibitions outnumber permissions
These documents are written mainly as things not to do: do not estimate a delivery date, do not comment on a competitor, do not interpret a policy, do not confirm account details before verification.
The asymmetry exists because the risk is in the unusual answer, and enumerating acceptable answers for every situation is impossible while enumerating forbidden moves is not.
Each prohibition typically traces to a specific incident, which is why the documents read as a history of things that went wrong.
Every prohibition needs a fallback
Telling a system not to answer something leaves it to decide what to do instead, which is exactly the situation that produces improvisation.
Effective specifications pair each restriction with a defined response: acknowledge the question, state that a specialist handles it, and offer the transfer.
Without the fallback the assistant produces a refusal in its own words, and those words are the ones that end up quoted in complaints.
Regulated language cannot be paraphrased
In finance, insurance, health and telecommunications, certain statements must appear in specific approved wording, and a fluent rewording is a compliance failure.
This is handled by inserting fixed text rather than generating it, with the model restricted to selecting which approved passage applies.
Deployments that let the model paraphrase approved language are the ones that fail audit, and the failure is invisible in ordinary testing because the paraphrase reads well.
The document requires an owner and a cycle
Policies change, products change, and an assistant operating on last quarter's rules will confidently state things that are no longer true.
Organizations that treated the specification as a launch artifact rather than a maintained one found it stale within months.
The ones that hold up assigned it to the same team that maintains agent guidance, so it updates through a process that already exists rather than a new one nobody owns.