A guest in room 8 asks the in-room assistant, at midnight, whether they can bring their dog next time. The property has no pet policy recorded anywhere.
A general-purpose model will answer anyway. It will produce something reasonable-sounding — most small hotels allow dogs in ground-floor rooms for a small fee — in the property's voice, with nobody watching, and the guest will arrive in March with a dog and a screenshot.
The same failure covers breakfast times, late-checkout fees, whether the pool is heated and whether there is parking. Each wrong answer is a promise the property did not make and will have to either honour or refuse at the desk.
Grounding every answer in the property's own content, and refusing when nothing relevant is retrieved, is what makes an assistant safe to leave unattended. The refusal has to be reachable, which is a quieter engineering problem than it sounds: the similarity threshold that decides "nothing relevant" belongs to the embedding model, because a threshold tuned for one model can sit beneath another's noise floor and silently turn every refusal into an answer grounded in the least-bad passage.
The second guarantee is that it cannot act alone. Asking a question and spending money are two separate requests — the assistant can propose a booking and only a deliberate tap creates one, executed through the same audited billing path the front desk uses.
Why this matters to you: an assistant that says "I don't know, shall I ask reception?" costs you a phone call. One that invents a policy costs you an argument at check-in, and it will do it at scale, politely, in your name.