What we measured
On 13 August 2026 we checked how often our clones admitted they did not know something. The answer was uncomfortable.
We looked at every real visitor conversation and split it two ways: clones that had been given knowledge sources, and clones that had been given none at all. A clone with nothing to draw on should refuse far more often than one with a full library behind it. That is not what we found.
How often clones with NO knowledge said they did not know
How often clones WITH knowledge said they did not know
Characters of invented advice, worst single case
Those two numbers are statistically the same. Refusal behaviour had almost nothing to do with whether the clone actually knew anything, for a simple reason: nothing in the prompt ever told it that the search had come back empty. It had no way to know the difference between a well-stocked library and an empty room, so it wrote confidently either way.
A clone with no knowledge at all answered "how should we split songwriting equity in my band" with 4,300 characters of confident advice on publishing splits, in its owner's name.
Worst observed case, measured 13 August 2026
Nobody complained. That is the part worth sitting with. A wrong answer that sounds right does not generate a support ticket, it generates a client who quietly acts on advice their coach never gave. You cannot fix what you cannot see, which is why the number above exists at all.
The retrieval guard
Telling the model when it has nothing sounds trivial. Our first attempt at it was exactly backwards in production.
The fix is a single instruction, added only on turns where retrieval found nothing relevant. It tells the clone plainly that everything it is allowed to state is already in front of it, and that the one thing it cannot do is introduce a new factual claim. Greeting, small talk, and expanding on something it already said all stay allowed, because a clone that refuses to elaborate on its own previous message reads as broken.
The first version keyed off whether the search returned any rows at all. Search runs two arms in parallel: a semantic one that understands meaning, and a keyword one that matches words. The keyword arm matches on any shared token, so a single common word counts as a hit. Measured against a live career coaching clone:
| Question asked | Keyword hits | Semantic hits |
|---|---|---|
| "What is the boiling point of mercury?" | 4 | 0 |
| "How should my band split equity?" | 2 | 0 |
| "hi" | 0 | 0 |
So the off-topic questions returned rows and switched the guard off, while "hi" returned nothing and switched it on. The clone answered a chemistry question and guarded a hello. It shipped that way, and it took reading the query plan to find it.
The guard now counts semantic hits only, because a chunk carries a similarity score above zero only if the meaning-based arm found it. We are documenting this failure rather than the fix because it is the more useful half. Any platform can describe the feature it intended to build.
Answer scope
One setting, on by default, that decides whether your clone is allowed to think for itself.
Only answer from my material. The default. The clone will not answer from general knowledge, so it cannot put words in your mouth. Asked something you never covered, it says so in two or three sentences and points the person to you.
Allow general knowledge. The clone may help beyond your material, but it has to open by saying the topic is not something you have covered, and mark the general guidance as general. It still cannot invent your prices, packages, availability, timelines or results.
Underneath both settings sit defaults the clone carries regardless: never make up pricing, packages, availability, timelines, guarantees, results or service details. Ask a clarifying question before giving detailed advice. Say "I am not sure about that" rather than guessing.
You can add your own on top. Three presets cover the common ones, no medical advice, no legal advice, no financial advice, and beyond that you can list things the clone must never say, things it should always mention, and topics it should decline outright.
The rule nobody can switch off
Every other control on this page is yours to configure. This one is not, deliberately.
Coaching conversations occasionally go somewhere no coaching product should try to handle. A crisis check runs before the model is called at all, which means it cannot be bypassed by a clone's configuration, by a custom instruction, or by someone deliberately trying to talk around it. If it fires, the clone stops being a coach. It says plainly that it is an AI, that this is bigger than it, and points to a real person.
The keywords are intentionally broad. A false positive costs a safety message somebody did not need. A false negative costs something else entirely.
It is not a setting, it does not appear in your guardrail options, and there is no way to turn it off. That is the point of it.
Correcting a wrong answer
Finding a bad answer is only useful if fixing it takes a minute and actually holds.
You read the conversation. Every exchange your clone has is visible to you. Not a summary, the actual messages.
You rewrite the answer. In your words, the way you would have said it.
It becomes authoritative. The correction is stored as part of your clone's knowledge and outranks anything else it retrieves on that topic.
You see it worked. The clone is asked the same question again and shows you the old answer beside the new one, so you can confirm the correction took rather than hoping it did.
The last step matters more than it looks. Plenty of systems accept feedback and quietly do nothing with it. Showing the before and the after is how you know the difference.
Before it goes live
A clone should never reach a client before its owner has argued with it.
Clones are created switched off. A new clone exists, holds your material and answers you, but nobody else can reach it until you deploy it deliberately. There is no state in which something half-trained is quietly answering your clients.
Before that, you can sit and interrogate it privately. Ask it the awkward questions, the ones a difficult client would ask, the ones about price and availability where an invented answer would cost you. Correct anything it gets wrong on the spot. None of it counts against your usage and none of it appears in your conversation history, because it is practice rather than a client.
What to ask any vendor
Useful whoever you end up buying from, including if that is not us.
Can I read what my clone actually said? Some platforms deliver through channels where the owner cannot see the conversations at all. That is a defensible privacy choice, and it also means you can never find a bad answer, let alone fix one.
What happens when the search finds nothing? This is the question that separates a real answer from a marketing one. If nothing in the system tells the model that retrieval came back empty, it will answer anyway, confidently.
Can I correct an answer, and does it stick? Ask to see the before and after. Feedback that disappears into a queue is not a correction mechanism.
Is anything reviewed before it reaches a client? Ask whether a clone can go live by default, and whether there is any state where it answers before you have tested it.
What is a "guardrail" here, exactly? An instruction written into a prompt is a request. Something that runs before the model is called is a rule. Both are reasonable, but they are not the same thing and the word covers both.
Have you measured any of this? Ask for a number about how often the clone gets things wrong. Almost nobody has one, which is itself the answer.
If you want to see how ours behaves, the honest test is to ask it something its owner never covered and watch what it does. You can try that on a clone we built or on your own, free, in about ten minutes.
Questions
Can an AI clone be stopped from making things up entirely?+
No, and any vendor who tells you otherwise is overselling. Language models generate plausible text, and plausible is not the same as true. What can be done is narrow the gap: keep the clone to material its owner supplied, tell it explicitly when retrieval found nothing, and give the owner a way to correct an answer so the same question is answered properly next time. That is the difference between a system that fails loudly and one that fails convincingly.
What happens when someone asks my clone something I never covered?+
By default the clone says it is not something you have covered and invites the person to contact you directly, in two or three sentences. It is specifically prevented from constructing an answer out of general knowledge, because a plausible answer to a question you never addressed reads to your client as your professional advice.
Can I let my clone answer from general knowledge instead?+
Yes. Answer scope is a setting, not a lock. If you switch it to allow general knowledge, the clone must still open by saying the topic is not something you have covered, and must mark the general guidance as general rather than passing it off as your position. It is still prevented from inventing your prices, packages, availability, timelines or results.
Can I see what my clone has actually said to people?+
Yes. Every conversation is visible to the owner, and any individual answer can be corrected. This is worth checking with any platform you consider, because some deliver through channels where the owner cannot read the conversations at all, which means there is no way to find a bad answer or fix it.
What happens if someone tells my clone they are in crisis?+
A crisis check runs before the model is called at all, so it cannot be overridden by a clone configuration or by prompt injection. If it fires, the clone stops being a coach, says plainly that it is an AI and this needs a real person, and points to a helpline. The keywords are deliberately broad, because a safety message someone did not need costs very little and a missed one does not.
Does correcting an answer actually change anything?+
Yes. A correction is stored as part of your clone’s knowledge and treated as authoritative, so it outranks anything else the clone retrieves on that topic. After you save one, the clone is asked the same question again and you see the old answer and the new one side by side, so you can confirm the correction took rather than assuming it did.
Ask it something you never taught it
It is the fastest way to judge any AI clone, including this one. Build yours free, then try to catch it out.
Free tier available. No credit card needed.