The danger with a guest-facing assistant is not silence. It is a confident, wrong answer about breakfast times, the pet policy or a late-checkout fee — delivered in the property's voice, at midnight, with nobody watching.
Answers are grounded in the property's own content, and when nothing relevant is retrieved the assistant refuses and offers reception. The similarity floor deciding "nothing relevant" belongs to the embedding model rather than the retriever, because a floor tuned for one model can sit beneath another's noise floor and quietly make refusal unreachable — at which point every refusal silently becomes an answer grounded in the least-bad passage.
The separation that matters most is structural: asking a question and doing something are two different requests. The answering path can propose a booking; it cannot create one. A guest confirms with a deliberate tap, and only then does a second endpoint execute — delegating to the same audited billing action the front desk uses rather than reimplementing it.
Nothing in the proposal is trusted at execution time. The room comes from the URL, the target is re-resolved from the catalogue, its price is read server-side, and the action type is re-checked against the property's allow-list in case it was revoked between the proposal and the tap.