What it can’t do

The limits, stated before you install it rather than discovered after. Some are design choices we would make again; some are gaps we know about. Both are listed.

It answers. It does not act.

The assistant cannot look up an order, take a payment, change a booking, create an account or do anything else on a visitor’s behalf. There is no machinery for it, and the assistant is built never to imply there is: it will not say “I’ve passed that on” unless something actually passed it on. The one action that exists is Pro’s escalation by email — a person gets the transcript — and the assistant may offer it only when it is switched on and has somewhere to send it.

It does not browse.

Answers come from the knowledge base you built and the list of pages on your site. It does not search the web during a conversation. Pro can add external web pages as sources, but those are fetched and indexed in advance on your instruction, not visited live in response to a question. A web address a visitor pastes in is never followed and never linked to.

It will refuse things your content nearly covers.

The grounding checks are tuned against the confident wrong answer, which means they will sometimes block a reasonable one. A question your pages almost answer will be declined where a looser product would have guessed. The chat log shows you each refusal so you can write the missing page; When it says “I don’t know” explains the trade.

It is not a guarantee of correctness.

AnswerRails checks the model’s output structurally — the links exist, the answer had grounding, the sources are named. It cannot verify that a grounded answer reads your content correctly; that is still a language model summarising text. Two known soft spots: on some provider paths the model’s own signals are unavailable and an answer can reach the visitor without the grounding check, visibly recorded as such in the log; and the method that chooses which sources to display can, on an unlucky overlap, credit a source the answer did not really use. Read the Sources list as the assistant’s working, not as a proof.

Moderation has edges.

Every message is checked by your provider’s moderation service, and the check cannot be switched off. But the check is the provider’s, with the provider’s categories: Mistral has no dedicated category for content involving minors, and on Anthropic the check is a classifier prompt rather than a dedicated endpoint. If the moderation service is unavailable, the assistant fails closed — the visitor is asked to try again and the message is not answered. Enforcement is per session: a visitor who is cut off can open a new one. reCAPTCHA is the tool for that, and it is optional. The self-harm response points to a universal helpline directory; a regional number is a Pro string edit.

Things that are simply not built.

• Multisite is not supported.
• A visitor cannot export or delete their own data from the widget. Data requests go through you, with the tools on the Chat Logs screen and in WordPress’s own privacy tools.
• Images and attachments cannot be sent by visitors.
• Knowledge items are not editable after creation. To change one, remove it and add it again. Pages and posts added as sources do track their originals: edit the page and the source follows.
• The privacy audit trail is not tamper-evident. It is your record of what was done, not independent evidence.
• Consent interop with cookie-banner platforms is not built; the plugin’s consent is its own.
• No language support claim. The answer language follows the model and your content; the plugin makes no promise about which languages work well.

Your provider’s terms still apply.

Because the model runs on your account, your provider’s terms of service are between you and them. In particular, Mistral’s terms make you responsible for your end users and place the qualification to give professional advice on the deployer, not the model; the setup walkthrough reminds you to turn off Mistral’s free-tier training, and doing so is your responsibility. If your site gives advice that is regulated where you operate, the assistant does not change that.