AI assistant

The assistant is a chat panel, opened from the Assistant button at the bottom corner of every page (or Ctrl+J, ⌘J on a Mac). There is also a full page, Assistant → Chat in the sidebar (/admin/assistant; in the employee portal, Assistant under Me, /portal/assistant), with the conversation history, search, rename and delete, a wider thread and a bigger message box. The panel's Open full page icon opens the same conversation there, and the floating button is not shown on the full page. People ask it in plain words — "what's my leave balance?", "apply for two days' leave on 15 and 16 November", "show the appraisal ratings for the last cycle" — and it answers by reading the same data the page would show them, or prepares an action for them to confirm. It replies in the language the person uses the app in (English, Arabic, French, German or Spanish).

Private beta

The assistant is not part of any plan yet. During the beta a workspace has it only when the operator grants it to that workspace. A workspace without the grant does not see it in its menus, and opening its address directly shows Not available yet: "It is in a private beta, switched on for selected workspaces only." When it is on, the button appears for everyone who holds the Use the AI Assistant permission, which every system role has by default, unless the assistant is switched off on their employee record (see Who can use it).

What it can do

Everything the assistant does goes through the same routes as the pages. It has no access of its own: a person is offered exactly the tools their permissions and plan open, and nothing else is even visible to it. Someone without an employee record (an admin-only login) is offered neither the personal tools nor their suggested prompts; the panel opens on the workspace tools instead.

For anyone with an employee record: their own profile, leave types and balances, leave applications, attendance, holidays, payslips (with a PDF link), appraisals, loans and loan eligibility, expense claims, assets, HR letters and letter requests, contract, tax certificates, performance tasks, scores, daily and sales reports — and their own requests, each prepared as a card for them to confirm: a leave application or cancellation, an attendance regularisation, an overtime claim, an expense claim (or its withdrawal), a loan application, an HR letter request (or its withdrawal), starting or completing a task, the daily report and the weekly sales report.

For approvers, decisions as cards: approve or reject a leave application, a regularisation, an overtime claim, an expense claim (the manager's step and HR's), a loan; reject a letter request with the reason the employee reads; grade a submitted task. The card shows the request as the approver's own page shows it; the route still refuses the approver's own request, one outside their team, or one already decided.

Hiring, contracts, appraisals and access, as cards (each with its own permission): job openings (create, change, publish or unpublish the posting), moving an application between stages (a reason when rejecting), scheduling an interview, extending an offer and recording the candidate's answer, converting a hired candidate into an employee (work details only); contracts — create, activate, renew, revoke an acceptance, terminate (the card says it cannot be undone); appraisal cycles — create, change, activate or close, roll out (the card says how many people it reaches), change a reviewer, finalise, and the self review and manager review with every competency rated; user accounts — create, change roles or deactivate, re-send the set-up email; roles — create and change permissions. Never by chat: a candidate's or employee's contact and identity details, password resets, signing in as someone else.

Money, for whoever holds the payroll permissions: a salary increment or decrement, asked for as the new salary or as a percentage ("a 10% raise"; the new salary is then worked out from the current one and rounded to whole units), the card showing current → new, the amount and the percentage, a bonus or a payroll adjustment for a month (refused once that month's payroll is locked), cancelling either, a salary structure assignment (before → after, with the components), a provident fund entry (balance before → after), a tax adjustment, pausing or resuming a loan, emailing one payslip (the card shows the work email it goes to, or says it goes to the personal email on file, which it never shows), running payroll for a month (the card is the pre-flight: blockers refuse), and the run's steps — approve, send back to review, lock, mark paid, finalise — each card naming what the step does and whether the run is in a state that allows it. Company bank accounts are never part of a card; a disbursement booked against one is marked paid on the run's page.

For HR and admins, record changes as cards (each with its own permission, exactly as the page): add an employee (work details only — identity, bank and address are added on the employee page afterwards), change an employee's work details, status, department or designation, promote, confirm after probation, assign a shift; create or change departments, designations and holidays; accept or dismiss a holiday suggestion; draft an announcement and publish it (the card says how many people it reaches and whether emails go out); update onboarding tasks and run their actions; open a separation, update clearance items and complete the final settlement (the amounts are the settlement preview's); register, issue and return assets. Every one is prepared by the server's own checks and happens only on Confirm.

By module, for whoever holds the page's permission:

• People — find an employee by name or code; their profile (never identity, bank, address or phone); probations, transfers, promotions, separations; documents (names and status, not the files); document compliance; departments, designations, shifts, employment types, branches, fiscal years; the admin dashboard.
• Attendance — a day for the company or a team, an employee's month, regularisation and overtime requests, clock punches.
• Leave — any employee's balances and applications, who is on leave in a window, a manager's team, pending approvals, leave types and groups.
• Payroll (plan feature) — runs and their entries, an employee's payslips and any slip's figures with its PDF, the pre-run check, salary assignments, provident fund balances and ledgers, components and structures. Bank account numbers and the bank file are never shown.
• Tax — the certificate summary for a fiscal year, adjustments, own certificates (where income tax applies).
• Loans — all loans, pending ones, an employee's, outstanding balances; own loans and eligibility.
• Expenses — own claims, a manager's team claims, all claims, categories.
• Assets — own assets, the register, an asset's history, categories.
• HR letters — own letters and requests, templates, issued letters, requests.
• Contracts — own contract, all contracts, expiring ones, templates.
• Onboarding and offboarding — pipelines and tasks, separations, clearance and the settlement preview.
• Performance and appraisals (plan feature) — scoreboard, an employee's score, tasks, daily and sales reports, increment recommendations, appraisals and templates, the reviews assigned to the person, own appraisal.
• Recruitment (plan feature) — openings, candidates (never their contact details), applications and offers.
• Field visits (plan feature) — visits, summaries, clients and staff, own visits; never a position.
• Reports (View All Reports, reports.all) — every report of the Reports section (employees, attendance, leave, payroll, tax, loans, appraisals), each with its kinds, as tables with a short summary.
• Audit and users — the activity and sign-in logs (who did what, when; never the request bodies or addresses), users and roles.

Every card carries an Open in the app link to the page the data comes from, and long tables fold after thirty rows. Links use the workspace's own web address (its custom domain, when it has one). A PDF opens in a new tab under the person's own sign-in, so a link passed to someone else opens nothing for them. The assistant only links to the workspace's own pages and files.

What it never shows anyone, in any tool: national id numbers, bank details, home addresses, personal phones and emails, dates of birth, positions, IP addresses, file locations. Money figures follow the page: whoever may open the payroll page sees the same figures in the chat, and nobody else does.

What it does not do (use the page): verify a document or review a photo (it cannot see files), edit a profile, enter a verification code, acknowledge a payslip or accept a contract (those record your device as evidence), clock in by position, and change settings.

What keeps it safe

Three things, none of them a prompt.

It acts as the person, through the app. Every tool call is a request to this workspace's own API, sent with the person's own session. The route's permission check, the plan gate, the "which employee is my" logic and the audit log all run exactly as if the person had opened the page. A tool that looks at someone else takes an employee id, and that id must have come from a search in the same conversation — the assistant cannot invent one or be fed one. The route then decides exactly as the page would: an HR officer sees the company, a department head their team, an employee nobody but themselves. "Show me Ali's payslip" from someone without Salary slips: view all gets a plain "that is not available to me here"; from a payroll manager it gets the slip and its PDF.

It never changes anything by itself. A request like "apply my leave" or "approve Sara's leave" makes the assistant propose the action: the server runs every check the form runs (for leave: dates, holidays and weekly offs, the sandwich rule, balance, overlaps, whether a document is needed; for a loan: the type's limits and the instalment it would deduct; for an approval: that the request is still pending and inside the approver's scope) and the chat shows a card with what the server computed. Only pressing Confirm on that card submits or decides — and that is an ordinary request of the person's own, so the emails and the audit entry are the same as from the page. The audit row names the card it came from. A card can be confirmed once, expires after ten minutes, and the assistant is told on the next turn whether it was confirmed or cancelled. Problems come back in plain words, all at once, from the same checks the page runs.

Its numbers come from the data. Tables and cards are drawn directly from what the routes returned; the assistant only writes the narrative, and a reply that quotes a figure not present in that data is withheld (the cards still show). It also receives a strict allow-list of fields: national id, bank details, addresses and phone numbers never leave the server, whatever the route itself returns.

Threads are private to the person who started them — an administrator of the workspace cannot read them, and a support person signed in as someone else cannot open the assistant at all. Reads the assistant makes are logged (assistant_tool_calls) alongside the normal audit log, which records the writes.

AI credits

Every message the assistant answers uses AI credits, a unit of AI usage. A short question takes a few credits; a message that reads several modules or prepares a card takes more. Most messages use a few dozen. Manage everything about credits under Assistant → Usage & credits (/admin/assistant/usage), open to people whose role has the company settings permission, the same one that opens Billing. The Billing page also has an AI credits card with the credits available now and a Usage & credits button.

The Usage & credits page

The page is titled AI assistant usage & credits and starts on the current month; Month picks an earlier one.

• Available now: what is left of this month's allowance plus your purchased balance.
• This month's allowance, and how it was worked out, for example "Growth plan: 1,000 + 40 per employee × 25 billed seats".
• Used this month, with the number of messages and the average credits per message.
• Purchased balance: credits you bought, which never expire.
• Buy credits: the packs on sale, each with its credits, its price and its price per 1,000 credits.
• Credits per day: a chart of the month, with Show as table.
• People: every current employee with their assistant switch, monthly limit, credits used, messages and last use, the Default monthly limit per person, and Turn on for everyone / Turn off for everyone.
• Admin logins: logins without an employee record and what they used.
• Credit history: monthly allowances, purchases, adjustments by your provider, and refunds or chargebacks, with the purchased balance after each.

Your monthly allowance

Your plan includes credits every month: a base amount for the workspace plus an amount for each employee you are billed for. The allowance is set at the start of each calendar month (UTC) and does not roll over. When it goes up during the month (a bigger plan, more billed employees, or a trial becoming a paid plan), the higher allowance applies to the current month from the next time someone opens Billing or Usage & credits; when it goes down, the change waits for the following month. A workspace on a trial gets a smaller trial allowance. A workspace whose subscription has expired or been cancelled gets no allowance; while a failed payment is being retried, the allowance stays. The Usage & credits page shows this month's allowance, how it was worked out, what has been used, and what is left.

Buying more

When you need more, buy a credit pack on the Usage & credits page, which shows each pack's price. You pay by card through Stripe; the credits are added as soon as the payment clears, and the invoice appears with your other invoices under Billing. Purchased credits are used only after the month's allowance runs out, and they never expire. If the pack list changes while the page is open, the purchase is refused and you are asked to reload, so you never pay a price you did not see. Where online payment is not set up, the page says so; contact support to add credits.

A refunded pack gives back its credits in proportion to the money refunded, and a chargeback that goes against the payment takes all of them back. Both appear in the credit history as Refund or chargeback. If the credits were already used, the purchased balance can go below zero; the next purchase covers it.

Who can use it

Each employee has an AI assistant switch and a monthly credit limit, in the AI assistant section of the employee form (Can use the AI assistant and Monthly AI credits). The section appears only while your workspace has the assistant.

• On the Add employee form the switch is ticked by default and the limit is pre-filled with the workspace default. Untick it to keep the assistant off for that person.
• Change either at any time from the employee's Edit page, or for many people at once from Usage & credits, which lists everyone with their use this month and can switch the assistant on or off for everyone at once.
• The default monthly limit (1,000 credits unless you change it) applies to everyone without a personal limit. On the employee form, a limit left equal to the default is saved as "follow the default", so it changes when the default does. On Usage & credits, leave a person's limit empty to follow the default (the empty box shows it, for example Default (1,000)); a number typed there stays as it is when the default changes.
• You can't change your own switch or limit on your employee record: the section is read-only there, with a note. An admin changes it from Usage & credits.

People who can manage billing and AI credits (their role has the company settings permission) have no personal limit: they could lift it themselves anyway. The same goes for logins without an employee record (an owner or admin account). Both draw on the workspace's credits directly. On Usage & credits, a credit manager's limit reads No limit (manages credits), and logins without an employee record are listed under Admin logins. To stop one of them using the assistant, remove the assistant permission from their role (see below).

When credits run out

• Someone switched off does not see the Assistant button; the full page tells them the assistant is not switched on for them.
• Someone who reaches their own limit is told so and can send again next month, or sooner if you raise their limit.
• When the workspace has used its allowance and has no purchased credits left, everyone sees that the workspace's AI credits are used up for the month; an admin can buy a pack to continue straight away.

Earlier conversations stay readable either way.

Limits

• 40 messages per conversation. After that the assistant answers "This conversation is full. Start a new one."; start one with New conversation (the + in the panel) or New chat on the full page.
• A daily cap per person (50 messages by default), on top of AI credits. At the cap the assistant answers "You have reached today's limit of 50 assistant messages."
• Conversations are deleted after 90 days (the operator can change both numbers).
• Attachments cannot be uploaded in the chat: when a leave type needs a document, the card says so and the request goes through the Leave page.

Turning it off for a role

Remove Use the AI Assistant (assistant.use) from the role under Access control → Roles. The button disappears for those people on their next sign-in. Holding the permission adds no access — it only opens the panel.