Why we say no to Lumi, sometimes
Every AI feature we didn't ship says as much about tentus as the ones we did. A running list of the guardrails, and why each one is there.
It's easy to describe a product by what it does. It's more revealing to describe it by what it refuses to do, because that's where the actual values show up.
No fabricated answers
Lumi only knows what's in your workspace. If a fact doesn't live in a note, a transcript, or a connected source, Lumi says so instead of generating a plausible-sounding guess. We've written about this one before because it's the foundation everything else stands on — a thinking tool that fills gaps with confident fiction isn't a thinking tool, it's a liability with good manners.
No silent actions
Every action that reaches outside tentus — a Slack message, a calendar invite, an email — waits for an explicit confirm click, every time, no matter how clearly the request was phrased. The confirm step isn't a bug we haven't fixed. It's the actual trust boundary, and it doesn't get optimized away for the sake of a smoother demo.
No unbounded loops
When Lumi chains multiple steps together — summarize a meeting, then post it to Slack — that chain is capped at a fixed number of model calls per request. Not because a longer chain wouldn't occasionally be useful, but because an uncapped agent loop is a cost and reliability risk that isn't worth the marginal cases it would cover. Bounded and predictable beats clever and occasionally runaway.
No arbitrary tool access
The list of what Lumi can even attempt to do is a hand-vetted allowlist, not "whatever the model decides makes sense from an open catalog." Every connector on that list has a working, tested integration behind it, and every one of them went through an actual decision about whether it belonged there. We were offered the option to swap this for a much larger generic catalog and turned it down — the safety property of a small, understood list is worth more than a bigger checkbox on a comparison chart.
No personality for its own sake
Lumi doesn't crack jokes, doesn't volunteer opinions, doesn't perform warmth it doesn't need to. It's a thinking layer, not a companion app. Every product in this category faces pressure to add a "personality" layer because it demos well — we've deliberately left it out, because the actual job here is the thinking, not the performance of being liked while doing it.
Taken together, these aren't limitations we're apologizing for. They're the shape of what a second brain has to refuse to do, in order to be one you can actually rely on.