Read broadly, write narrowly: how a team of 12 runs a company with AI under control

The question investors ask me most is: if you let AI do this much, what happens when it gets something wrong?

It is the right question, and I do not answer it by promising that our AI will never be wrong. I answer it by designing the system so that one mistake cannot travel far. If a rule lives only in a document, it is not a rule. For AI to be safe, the guardrail has to sit inside the system, at a place the AI cannot route around.

The principle: read broadly, write narrowly

HOPE is a beauty-from-within and wellness company run by a team of about 12 people. At that size, we could not keep up with the volume of work without AI across the whole operation. But using AI broadly does not mean granting it broad authority. Our principle fits in one line: AI reads broadly and writes narrowly.

Reading broadly means the AI can see almost the entire flow of work: orders, waybills, messages, advertising numbers, payroll. That visibility is where the value comes from, because most operational errors arise when nobody is looking at enough things at the same time. Writing narrowly means the part of the real world the AI is allowed to change is a thin slot, and that slot always has either a person or a hard cap standing guard.

What AI reads at HOPE

AI currently runs across seven main functions:

• Order parsing: orders posted in chat groups are turned into a revenue ledger automatically.
• Reconciliation: the ledger is matched against J&T waybills and bank statements. This gives us reconciled revenue figures, starting from 2026.
• Lead routing: the system assigns leads and flags customers who are waiting, on the principle that whoever owns a customer serves that customer, measured by real messages rather than button clicks.
• Drafting customer replies: the system prepares replies for staff to read, edit and approve.
• Content factory: it drafts posts, and every post passes through a banned-claims filter before it reaches a human reviewer.
• Operations advisor: an assistant that runs around the clock on Telegram, reads live numbers and reports daily. My rule is that every report must come with a recommendation, not just numbers.
• Monthly payroll: the system computes the payroll, which accounting and I then approve.

That list may sound like a company that has handed nearly everything to machines. The truth is the opposite: at every step the machine produces a draft, a figure or a recommendation. The final decision stays with a person.

Where write access is locked

This is the heart of the essay. I list the controls specifically, because these are the questions an investor should ask any company that says it uses AI. Why the guardrail must live in the system rather than in a document is the story I told in Only publish reconciled numbers.

• Anything going outside is approved by a person. Posts and customer replies are drafted by AI and sent only after someone approves. The system does not publish or send on its own.
• AI cannot move money. It has no permission to make payments, delete data or change infrastructure.
• AI cannot raise ad spend on its own. Ad autopilot is off by default: the system only measures and recommends. Every budget increase, even a manual one, is capped at VND 1 million per day (about US$38) in exactly one place in the code. The budget control exists only in my private chat, never in a group that includes staff.
• Customer data is masked before it reaches AI. Phone numbers and emails are masked before being given to the system or included in reports. The assistant answers only in allow-listed chats. Our AI call logs record counts and tokens, never content.
• The code repository has an automatic gate. Any commit that contains a list of phone numbers, secret keys or secret configuration files is blocked. We built this after a real incident in which customer data reached the repository unnoticed: the rule already existed in writing, but words do not stop a command.
• Content passes a single filter. Our products are dietary supplements, not medicines. The filter blocks medical claims, time-bound result promises and percentage discounts, because HOPE promotions are gifts only.

I want to say one thing plainly: these guardrails do not make the AI weaker. They are what lets me hand it more work. When I know the worst the system can do is write a poor draft, I can widen what it sees without losing sleep.

Measured, with real scores

Locking write access is only half the story. The other half is knowing how well the machines perform, in numbers rather than impressions.

Each important AI agent has an eval suite: an automated test set built from real cases, run every Sunday. The operations advisor has 22 cases, lead routing 16, Zalo customer replies 15 and sales-chat scoring 13. The latest scores, on 10 October 2026, were 20/22, 16/16, 15/15 and 12/13. I do not hide the two cases missed by the operations advisor or the one missed in sales scoring, because those are exactly what tell us what to fix next week. The suites also include cases designed to tempt the AI into breaking advertising rules, to test whether the guardrail actually holds.

Eval scores are also the condition for expansion. An agent gets more responsibility, and we switch to a new AI model, only when scores match or improve. That turns an upgrade from a gamble into a controlled step.

In parallel we measure real customer response time. Over the 30 days to 10 October 2026, the median was 1 minute and 80% of messages were answered within 15 minutes. These come from actual messages, not self-reporting.

Another incident gave us a further rule: failure must be loud. Once, a data source lost its login session and wrote a zero over the real figure of 1,481. Since then, a scraper that returns zero rows must stop, must not write, and must raise a warning flag. A watchdog monitors every source.

What investors should understand about HOPE

First, AI at HOPE is not a feature for show. It is operating leverage: costs scale with software rather than headcount, so a small team keeps pace with orders, customers and content. Our paid advertising spend in 2026 is about VND 34 million, roughly 1% of revenue, or about VND 26,000 (about US$1) per paying customer. Most demand comes from a community we own.

Second, this leverage is controlled and measurable. Write access is locked by mechanisms inside the system, not by promises. Quality is scored weekly with real numbers. Service speed is measured from real messages.

Third, I want to be clear about the limits, because honesty is part of the asset. Our eval suites are still small, between 13 and 22 cases each. A high score on a small test set is not proof for every situation, and we are extending the suites with new real cases as they appear. Nor do we treat AI as a replacement for human judgment. For a company selling products that people take into their bodies, I believe keeping a person at the point of decision is the right choice, even when the technology would allow us to go further.

Closing

After more than twelve years in technology and business inside Japanese companies, I carry one habit: a good system is one where, when a link fails, the next link catches the error before it reaches the customer. AI does not make that habit obsolete. It makes it more important.

If you are an investor or partner, the question I hope you ask us, and anyone else, is not "where do you use AI" but "what is your AI allowed to do, who stands behind it, and what was this week's score". At HOPE, all three answers can be checked.