Every proptech deck now has an AI slide. Most of it is a chatbot bolted to the side of systems that were never designed to be operated by software. The interesting question is what it takes for an AI agent to safely do work in a building, and the answer is governance, not model choice.
The bolt-on problem
A chatbot that can read your FAQs but cannot act is a novelty. A chatbot that can act without scoped permissions is a liability. An agent is only as trustworthy as the surface it acts through: if that surface is screen-scraping and a shared admin login, no amount of prompt engineering makes it safe, because the system underneath has no way to say no.
Every action as a role-scoped tool
In BTR OS, every operator and resident action is already a governed, role-scoped tool. There are 47 of them live today, covering everything from granting a credential to confirming an amenity booking. An agent working that surface cannot exceed the permissions of the role it holds, because there is no other way to act.
The guardrail is the architecture, not a promise layered on top of it.
This is the part most AI announcements skip. The hard work is not connecting a model; it is building an action surface where every capability is scoped, auditable and revocable before any model touches it.
Assist first, then act
Autonomy should be staged. Sentinel, the agent being brought up inside BTR OS, assists first: drafting, proposing and preparing while a person confirms. Where a module has earned it, it then acts within guardrails. Autonomy is earned module by module, never assumed platform-wide, and it can be withdrawn the same way.
One audit trail for humans and machines
Every AI action lands on the same immutable trail as every human action, attributable and queryable. When an auditor asks who granted access on a Tuesday night, "the AI did" is a complete answer only if the record shows which tool, under which role, on whose authority. If AI actions live in a different log from human ones, or in no log at all, the audit trail has a hole exactly where the risk is highest.
What to demand from any vendor's AI story
- Can the agent act outside the permission model? The only acceptable answer is no.
- Is every AI action on the same audit trail as human actions?
- How is autonomy staged, and who decides when it expands?
On BTR OS today, the tool surface is live and Sentinel is in build, chat first and voice next. We hold ourselves to the same standard we are proposing here: what we demo is what is running.