Hana began as a simple question: can an AI agent handle a real telephone conversation and make the useful next move for a business? The difficult part was never getting a model to speak. The difficult part starts when speaking can turn into a booking, a cancellation or a promise made to a customer.
A language model is good at producing a likely next sentence. A business needs something stricter when the sentence leads to a real-world effect. The system must know which appointment is being discussed, whether the caller is entitled to change it, what is available now, and whether the customer has actually confirmed the change.
A booking is not a reply.
That distinction shaped Hana. A caller can say, “Friday afternoon works.” It may sound like confirmation. It is still unsafe to treat that sentence alone as permission to create a booking. It could refer to the wrong service, an old option, or a question the caller has not finished asking.
The authority to make a booking sits in the runtime, not in the model’s confidence. Hana’s runtime owns the facts that matter: availability, booking lookup, caller authorisation, confirmation binding and protection against duplicate booking. It checks those facts before it permits an effect. If the check cannot be made, the system does not guess its way through.
Confidence is not a permission model. A good answer still needs the right to become an action.
Making Hana sound human did not change that.
Much of the recent work has been about a different problem: making Hana less robotic. A voice agent cannot wait silently while it processes a whole transaction. It needs to acknowledge a caller and ask a useful clarification when the conversation changes direction. The obvious shortcut is to let the model control the whole interaction.
We chose not to take that shortcut. The conversational layer can make the interaction feel alive: it can use the active context, phrase an acknowledgement naturally and handle the messy edges of speech. It does not get to authorise an effect. The runtime keeps the smaller, harder job of deciding whether an action is allowed and recording what happened.
The boring controls are the point.
This means keeping controls that do not make a good demo. Hana has confirmation bindings tied to the current interaction, receipts that show a confirmation was actually played to the caller, capability checks, idempotent booking claims and fail-closed state transitions. They exist because calls can be interrupted or duplicated, and external systems can fail at inconvenient times.
A model can still be useful inside those constraints. It can turn an ambiguous request into a clear next question. It can prepare work for a person. It can explain why the system needs a confirmation. The capability is real. What matters is that the capability stops at the boundary where evidence is required.
Rationality needs an instruction boundary.
The phrase I keep coming back to is rationality by instruction. A system should be able to reason about the work, but it should only carry out instructions that have survived the checks the business requires. That is not a limitation on intelligence. It is how intelligence becomes useful inside an organisation with customers and obligations.
Hana is still being built. We are still improving turn-taking and the context it can use. But the direction is fixed: better conversation must not weaken the authority boundary. Autonomy can expand later, one proven action at a time.