An AI agent is only as safe as the rules the application applies around it. Lavenity keeps four of those rules out of the model entirely: when the workspace is open, where it drives, what an emergency does, and what closes a finished qualification. They are policy documents the server reads on every message, not instructions in a prompt that a persuasive customer might talk around.
Why an empty policy is not a neutral one
The server has enforced all four since Qualify shipped. Until recently there was no screen for them, which meant that in practice they were usually empty — and empty is not neutral. A workspace with no service zones treats nothing as out of range. A workspace with no safety reply meets a gas or water emergency with silence. The policy editor exists so an owner sets these deliberately rather than inheriting whatever a blank row happens to mean.
Business hours start with an IANA timezone, shown back as the local time right now so a mistyped zone is visible before it is saved rather than after a customer receives an after-hours reply at noon. An unrecognised zone is called out, because the server falls back to a default rather than throwing inside a worker transaction. The week is then a set of intervals per day: an empty day means closed, an entirely empty week means not configured, and each day holds up to four intervals so a split shift fits comfortably.
Business hours: a timezone you can see and intervals that survive saving
Intervals are validated where they are typed, not silently dropped on save. The parser keeps only well-formed times in ascending order, which is correct behaviour for a half-migrated database row and wrong behaviour for a person typing 18:00–09:00 and expecting it to mean an overnight shift. The editor says why an interval will not be kept instead of letting it disappear between the form and the next page load.
Service zones are entered as a list and shown back as parsed pills with a count, so what the server will match against is visible rather than implied. An empty list is marked as a warning rather than left blank: with no zones configured, no address is ever outside the service area, and the calendar loses one of the few checks that can tell a dispatcher a postcode is a two-hour drive away.
Service zones, and the check a blank list quietly removes
Emergency policy is the one place the default is deliberately restrictive. Emergencies leave the automated path unless the owner decides otherwise, because in heating, gas, and water work a confidently wrong autonomous answer is a safety problem rather than a support-quality problem. Two replies sit beside that switch: an immediate safety reply during business hours, and an after-hours variant used instead when the workspace is closed. Leaving the safety reply empty means staying silent, so the editor says so plainly.
Emergencies default to a person, and the rest saves as one document
The completion message closes the loop by telling a customer that their details are complete and what happens next. All of it saves in one request alongside the autonomy mode, and every value is read back through total parsers: unknown or partially migrated input degrades to the safest default rather than widening what Ven is allowed to do. That is the whole point of keeping these four rules deterministic — a policy that can only narrow the agent is a policy you can reason about.
Configure the four policies before raising the autonomy mode
Set the timezone first and read the local time shown back before you save anything else. Every business-hours decision, every after-hours reply, and every slot the calendar offers is evaluated in that zone, so a wrong entry here misroutes each of the other three policies at once and does it silently.
Fill service zones even if you currently serve everywhere you are asked to. An empty list does not mean unrestricted in a useful way — it means the system can never tell a dispatcher that an address is far outside the normal area, which is precisely the warning worth having on the one booking that would have cost half a day of driving.
Write the emergency replies as if nobody will be at a keyboard, because that is the case they exist for. Keep the force-handoff switch on for anything involving gas, water, or heat, give the safety reply a concrete instruction rather than reassurance, and make the after-hours variant say when a human will actually respond instead of implying someone is already on the way.
Frequently asked question
What happens if Front Office policies are left empty?
The server still applies them, but an empty document is a permissive one. With no service zones, no address is ever out of range; with no safety reply, an emergency receives silence; and with an entirely empty week, business hours count as not configured. Parsers degrade unknown values to the safest default rather than failing, so nothing breaks visibly — which is exactly why the policies should be set deliberately before autonomy is raised.