Safety and grounding

Products, doses, rates and plans come from retrieval and computation, each with a source and a date. A missing fact is a stated gap, never a guess. Nothing is written until the farmer confirms.

Retrieve and compute

Products, doses and windows come from retrieval and computation with a source and an as_of, never from recall.

Gaps said out loud

A missing fact is named in the reply and not filled in. A stale as_of counts as a gap.

Propose, confirm, write

Agronomist proposes a change, the farmer confirms, then it writes. Writes are idempotent, so a retry never doubles a spray.

Re-read before write

Field and season are read again immediately before every write.

Registered products only

Product suggestions are filtered to what is registered for the crop and place.

Hidden tools stay hidden

Internal tools are never exposed to the farmer or callable from a prompt.

Flags without transcripts

When a conversation is flagged to a partner, the flag never carries the transcript.

Keys never reach a browser

API keys stay on servers. Browsers get short-lived embed tokens.

• Recommend a product that is not registered for the crop and country.
• Invent a dose, rate, interval or date it did not retrieve or compute.
• Write to a calendar, record or plan without a confirm.
• Give human or veterinary medical advice.
• Hide that it is an AI, or claim certainty it does not have.
• Share a farmer's conversation with a partner without a legal basis.

We measure grounding as the share of factual claims in an answer that trace to a retrieval or computation.

Write to safety@deepleaf.org. Include the conversation id if you have it, never a password or key.