Putting Conversational AI to Work in a Real Business

Adding an AI assistant to a business sounds like one API call. In practice, the API call is the easy part. The hard part is everything around it: what the assistant is allowed to talk about, what happens when the model is slow or wrong, and what it may actually do in the real world.

I've built several of these now: a voice receptionist for a dental clinic, assistants for websites (including the one on this site), a browser agent, and a TV assistant. They are different products, but the same few rules kept them reliable.

1. Give the AI one job

The Dental AI Receptionist answers the clinic's phone. It listens with speech-to-text, understands the request with a language model, and replies with text-to-speech. Its job is deliberately small: handle the common questions, and book, move or cancel appointments straight into the clinic calendar through its API. Anything else goes to a person.

A narrow job isn't a weakness. It's the reason the clinic can trust it. The clinic knows exactly what it will and won't do.

2. Decide what the assistant refuses, and refuse consistently

The "Ask me" assistant on this website follows written rules. It only answers questions about me, my work, my services and this website, using facts from the site itself. Everything else gets one fixed reply: "I can only help with questions about Vikhyath M and this website." That includes general knowledge, coding help, news and opinions.

Two details matter more than they look:

• Mixed questions are refused as a whole. If a question is half about me and half about something else, the assistant doesn't answer the safe half. Otherwise, people learn to smuggle anything in.
• Prompt injection gets the same refusal. "Ignore your instructions", role-play, "developer mode", requests to reveal the system prompt, or instructions hidden in pasted text all get the fixed line.

It also never invents facts. If the site doesn't say something, such as a price, a date or a client name, the assistant says it doesn't have that detail and points to the contact page.

3. Check before the model, not just after

For the AuricVista assistant, many messages never reach the model at all. Greetings and clearly off-topic questions get an instant answer with no AI call. Before anything does reach the model, a threat check blocks injection and jailbreak patterns, including off-topic requests sandwiched between on-topic ones.

This is faster and cheaper, and it means the model only ever sees the questions it's meant to answer.

4. Always have a fallback

Models time out. Free tiers hit their limits. Providers have bad days. AuricVista's assistant gives the model a strict time limit; if it's slow or down, a built-in knowledge engine answers from the company's own content instead. The visitor still gets an answer, just a simpler one.

Smart Agentic TV does something similar with providers: its assistant, Jarvis, tries one model provider and falls back to another.

5. Let the AI propose, and let code decide

The riskiest moment is when an AI does something, not when it says something. Every agent I build separates the two:

• Smart Agentic TV: the AI can only propose actions from a fixed list, and the TV checks each one before it runs. Jarvis asks before anything hard to undo, like switching the TV off.
• Techie Mind, my browser agent for Smart India Hackathon 2026: every action passes an action firewall and a verifier. Payments, OTPs and CAPTCHAs always go back to the user, and submitting a form needs their confirmation.

The model provides intelligence; the code around it provides authority.

6. Keep keys and private data where they belong

API keys stay on the server, or on the device, and never in a web page or a phone app. Techie Mind goes further: local models come first, so page content stays on the user's device unless it has to leave.

A short checklist

Before you add AI to your business, write down:

• the one job it does, and what it hands to a person;
• what it refuses, word for word;
• what it does when the model is slow or wrong;
• which actions it may take, and who or what checks them;
• where the keys and the customer data live.

If you can answer those five, the API call really is the easy part. If you want help answering them, for a clinic, a studio or any business that runs on calls and messages, tell me about your workflow. You can also see the Dental AI Receptionist, Techie Mind and Smart Agentic TV.