Why our AI shows its working
Language models are persuasive whether they're right or wrong. So we stopped asking you to trust ours — every figure is re-checked against your live data, every change is signed, and one click walks it back. Here's the engineering behind that decision.
There is a specific moment when someone stops trusting an AI feature. It isn't when the AI says "I don't know." It's when the AI states a number with total confidence — "your open pipeline is £248,400" — and the person checks, and the real figure is £212,000. Nothing else the tool says lands the same way afterwards. Confidence without receipts is how trust dies.
Language models are extraordinary at reading intent and terrible at arithmetic accountability. They don't know when they're wrong, and they phrase their errors exactly as fluently as their facts. Most products handle this with a disclaimer — a small grey line saying AI can make mistakes — which quietly moves the burden of verification onto you, the person who asked precisely because you didn't have time to check.
We made a different call. The AI doesn't get to do its own arithmetic.
Claims, not calculations
When the AI in RowFold answers a question about your data, any figure it states is treated as a claim, not a result. Alongside the prose, it declares each claim in a structured form — this number, from this aggregate, over this table. RowFold then re-executes that aggregate against your live database, server-side, before the answer reaches you.
If the re-run matches, the answer carries a verified badge. Click it and you get the receipt: the exact query that was replayed, and the number it returned. Not a summary of the working — the working.
If the re-run doesn't match, the answer says so, in the answer. Charts get the same discipline: any chart under an answer is recomputed from the aggregate it names, never drawn from what the model wrote. A chart is just a claim with bars.
Publish the misses
Every workspace keeps a running tally: how many claims were re-checked this month, how many held, and how many didn't. The failures are on the counter deliberately.
This was debated, because a counter that can embarrass you feels like a marketing mistake. We think the opposite is true. A tally that can only ever report success carries no information — it's an ornament. The moment a counter can say "3 checks didn't hold, and the answers said so," the other number starts meaning something.
Sign the changes
Verification covers what the AI says. What it does needs a different guarantee.
Everything the AI creates or changes in RowFold lands in the audit log under its own name — AI · Ask (for you) — the same way API writes appear as API · token-name and automation writes as Automation · its-name. "Who changed this?" has one consistent answer, and an AI write is never dressed up as a human one. Records the AI creates come with an Undo on the confirmation itself; they move to the Trash, restorable like anything a person deletes. Schema changes don't even get that far without you — the AI proposes, you approve, nothing lands silently.
And the AI operates under your permissions. A field hidden from you never enters its context — not in answers, not in summaries, not in search. The Ask page lists the fields hidden from the AI for you, by name, because a guarantee you can read beats one you have to believe.
Honesty has to include the boring failures
The last piece isn't glamorous. When no AI model is configured, RowFold's AI surfaces degrade and say plainly that no AI was used, rather than pretending. When a verification check can't be re-run, the receipt says this check could not be re-run instead of quietly shrinking the denominator. When fair-use metering hiccups, it fails open — a billing bug should never be the reason a paying customer can't work.
None of these decisions makes the AI smarter. They make it checkable, which we've come to believe is the harder and more valuable property. The industry is racing to make AI do more things. Ours does plenty — it builds schemas, writes formulas, drafts automations, answers questions. But every one of those abilities sits on the same foundation: show the working, sign the change, and make the walk-back as easy as the walk-in.
Trust is a receipt, not a promise. If you want to test that claim, it's checkable too — the whole surface is documented here, and every guarantee on that page can be exercised in the product today.