Safety and Confirmation Model

Genie is designed to help inside FileMaker without hiding when a task is high impact.

The short version

• ASK is read-only.
• CODE is review-first and can surface preview and apply actions when Genie has enough context.
• QUERY is read-oriented output.
• DATA is explicitly confirmed and should be treated as high impact.
• Local MCP Bridge exposes read-only metadata/query tools plus review-first Workbench staging for CODE and DATA. MCP clients cannot generate, mutate, or apply during the tool call.
• Calculation Quick AI inserts draft calculation text only after calculation draft validation and dialog drift checks.

What Genie does not do silently

Genie does not silently change your FileMaker solution from a conversational question.

Instead, the product separates:

• explanation and planning
• generated output
• review steps
• explicit apply or confirmation actions

Local MCP follows the same rule. An IDE agent can stage supported CODE or DATA work into Workbench, but the user still reviews it in Genie before it enters that mode’s normal safety flow. QUERY stays read-only through genie_query, and ASK/planning stays in the IDE or normal chat.

What review looks like in CODE

When Genie can produce a usable CODE result, you typically see:

• Preview Code to inspect the result first
• Apply Code only after Genie has a validated result ready for apply

If Genie is not confident enough for that path, it can return warnings or a review-first draft instead.

What confirmation looks like in DATA

DATA is reserved for confirmed data and schema work.

Expect:

• an upfront warning when entering the mode
• explicit confirmation before execution
• stronger confirmation for broader or destructive changes

If you are unsure whether a task belongs in DATA, stop and ask in ASK Mode first.

What Calculation Quick AI can change

Calculation Quick AI is draft insertion, not apply automation.

It can place generated expression text into the open Specify Calculation editor after:

• Genie validates the response as a calculation draft
• the output avoids script, XML, patch, and schema shapes
• known field and function references pass available metadata checks
• the dialog/table/result/text snapshot still matches the captured dialog

It does not click OK, create scripts, edit script XML, or run DATA operations.

Activation and lock state

Activation is separate from provider configuration and is authoritative for UI access.

If Genie is locked:

• the recovery path is Manage Activation
• the main interactive surface stays disabled until activation or trial state allows access again

See Licensing and Activation.

Context is part of the safety model

Capture is not cosmetic. It tells Genie what it should reason about.

• Add Selection is best for the current script or selected rows.
• Add Scripts is best for multi-script work.
• Metadata Explorer helps ground names, tables, fields, layouts, and custom functions.
• Workbench can carry prepared metadata selections from an MCP client, then applies those selections before running the staged prompt.
• Calculation Quick AI uses the current calculation dialog and a capped metadata slice instead of full chat context.

Better context usually means fewer clarifications and fewer review-only responses.

When Genie asks you to slow down

Warnings, assumptions, and draft-only results usually mean:

• the request needs clarification
• the context is missing or stale
• the task crosses a boundary where Genie should not guess

When that happens, refine the target, capture the right context, or switch back to ASK before retrying.