Suggested, never blind.
Audited, always.

No consequential action — price move, offer, purchase suggestion — executes without an explicit human decision. Approve, edit, reject, and ignore are all first-class outcomes, all recorded.

AI may parse, classify, summarize, and explain. It may not calculate a plate cost, set a floor, change a price, or publish anything. The boundary is architectural, not a policy promise.

Costs, floors, servings, and eligibility come from auditable rules. The same inputs always produce the same numbers — reviewable line by line.

Every figure knows its source and its age. A cost from an unconfirmed invoice, or from six weeks ago, says so — and stale sources are labeled STALE, not silently reused.

ESTIMATED, EVIDENCE PARTIAL, CONFIRMED, NEEDS REVIEW, BLOCKED, STALE. States are text labels, never color alone, and never upgraded without cause.

Facts (confirmed invoice lines), derivations (deterministic math on facts), and predictions (demand, depletion) are typed differently and can never masquerade as each other.

Who approved what, when, on which evidence, with what estimated impact, and what actually happened. Permanent, exportable, yours.

Your invoices, recipes, and sales data are used to run your restaurant's intelligence — not to train shared models, not for resale, not for benchmarking against your competitors. Deleted on request.

Integrations are read-first. Any future writeback (e.g., to Square) ships only with per-action manager approval and explicit scoping — and is labeled honestly on the product page until it is real.