The risk with a guest-facing assistant is not that it fails to answer — it is that it answers confidently and wrongly about your breakfast times, your pet policy or your late-checkout fee.
Vestibel grounds every answer in the property's own content and refuses when nothing relevant is retrieved, offering reception instead. The similarity floor that decides "nothing relevant" belongs to the embedding model rather than the retriever, because a floor tuned for one model can sit below another model's noise floor and quietly make refusal unreachable.
Nothing is booked or charged without a deliberate tap. Asking a question and spending money are two separate requests by design: the model proposes, the guest disposes.