The assistant never writes your numbers
It writes the query that finds them. The platform runs that query against your system, renders the rows it got back, and tells the assistant only that a table with four columns and three rows appeared. The figures on your screen came out of your database and passed through nothing that could change them on the way.
Every figure on screen is a rendered query result
Not a number the assistant typed into a sentence. A block the platform built from the rows the query returned, with the call that produced it attached to it: the tool, the table, the filters, the record count, and a handle that runs the same query again.
Question
Which customers are over their credit limit right now?
What the platform rendered
| Customer | Balance (DKK) | Credit limit | Over by |
|---|---|---|---|
| Nordisk Trædesign A/S | 412,900 | 350,000 | 62,900 |
| Vestjysk Maskinfabrik | 288,450 | 250,000 | 38,450 |
| Kolding Byg ApS | 197,200 | 175,000 | 22,200 |
Source
- bc__read_data · Cust. Ledger Entry (21)
- Open = true · Due Date < 2026-09-16
- 1,284 records read · 3 matched · not truncated
- bc:read:21:3f9a1c77b2e4
What the assistant was told back
{
"block": {
"type": "table",
"columns": ["Customer", "Balance (DKK)",
"Credit limit", "Over by"]
},
"row_count": 3,
"fields": ["Customer No.", "Customer Name",
"Balance (LCY)", "Credit Limit (LCY)"],
"truncated": false,
"status": "rendered"
}Column headers, field names, a row count. No values. The assistant knows a table appeared and can talk about what it shows. It never held the figures, so it cannot round one, soften one or remember one wrong.
- The call
The tool and the table, by name and number
Not "your ERP" but Cust. Ledger Entry (21), through the read tool, in the environment and company the session is connected to. A consultant can open the same table and see the same rows.
- The filters
Every condition the query applied
The filters are the definition of the metric, so they are shown rather than summarised. A figure quoted from a wider query and then pinned to a narrower one is caught by the platform and flagged, because the chart would stop matching the sentence.
- The count
How many were read and how many matched
Both numbers, plus whether the read stopped early. A live read pages automatically to 2,000 records; past that the result says it was truncated and no total is drawn from it.
- The handle
A path that runs the query again
Derived from the query itself and carrying no company, so the same handle answers for whichever company is asking. It is what pins the figure into a report, what a saved business term stores as its recipe, and what a nightly job re-runs to check the answer still holds.
And the sentences around the block are checked too
The assistant still writes prose beside the figures: what it filtered, what it noticed, what it would check next. That text is the one place a number could slip in without coming from a query, so before it is a message every figure in it is matched against what the tools actually returned this turn. Anything else is replaced and counted.
What you see
Roughly … DKK across … users.
The ledger said 812.400 across 3 users. A figure that was rounded, softened or misremembered is not the figure that came back.
2 redacted
And the query itself could not have overreached
Showing where a figure came from only helps if the query behind it could not have read something the person asking was never allowed to see.
- It runs as you
Your own connection, your own token
Every Business Central connection belongs to one user and holds that person's own delegated credentials. The assistant reads through them, so Business Central enforces the permission. A company, a ledger or a mailbox you cannot open stays closed, and that limit is not an instruction in a prompt that a clever question could talk around.
- Scope is below the tools
There is no tenant argument to get wrong
Where a tool could read across customers, the customer's identity is resolved beneath the tool layer and written into the query itself. The telemetry tools a customer gets cannot be pointed at another tenant at all, and there is no free-form query tool.
- Encrypted at rest
AES-256-GCM, wherever it is stored
Conversations, their tool results, attachments, generated files and every stored credential are encrypted. The encryption is authenticated, so data that has been tampered with is rejected rather than quietly decrypted.
- Everything is answerable
An append-only audit log
Every state-changing path writes an entry naming who did it, what changed and when. Entries are only ever added, never edited and never removed, so the log can be read but not quietly rewritten.
Where it stops instead of guessing
A confident wrong answer costs more than no answer, so several paths are built to end in a refusal.
- A truncated read
It says it stopped
A live read pages automatically to 2,000 records and the result carries whether rows were left behind. A report refuses to aggregate a read that hit its ceiling.
- An empty result
A blank block is refused, not drawn
An aggregate over no matching rows comes back as a single empty row. Rendering that as a dash would read as a zero, so the block is refused and the assistant says what it found.
- An unsettled question
It asks, and gives you the options
When several customers match, or the period or the measure is ambiguous, the assistant asks a question with two to six one-click answers rather than picking one and being confidently wrong.
- A full-table scan
It is refused, and the refusal names the index
A free-text pattern on a table above a quarter of a million rows with no indexed filter beside it is rejected, and the error names the fields that would seek instead.
Bring the question you think would break it
The honest test of this is an adversarial one, on your own data, with someone technical in the room.
Or write to us at hello@uni4c.ai