AI with hard limits.
You keep the keys.
Most “AI for farms” is a chatbot bolted to a spreadsheet. We took the opposite path: a multi-tenant system, a hard safety floor, and an autonomy dial you control.
The floor
Four things the AI can never move without your explicit, per-action confirmation. Autonomy dial aside — these are baked in.
- Enforced in the data layer, not the prompt.
- Holds across every entry point (web, mobile, API).
- Audited on every write.
Money
Sales, expenses, and adjustments always require explicit confirmation. The AI can draft, never post.
Inventory
Feed, meds, and consumables move only on a confirmed record — never on a chat message alone.
Livestock
Mortality, sales, and transfers require a record with reason + photo/note when relevant.
Destructive ops
Bulk deletes, role changes, and farm deletion are gated by re-auth and a 24h grace window.
Multi-tenant
Built for many farms on one database — without leakage.
Tenancy is enforced at every layer: API, queries, and the AI retrieval path. Not in a wrapper. In the data.
Every row is farm-scoped
No query path returns data from another farm — not in API, not in exports, not in AI retrieval.
Server-side RBAC
Permissions enforced in every server action. The UI is a convenience, not a wall.
Tenant-aware embeddings
RAG retrieval filters by farm_id at the SQL level. No cross-tenant leaks in vector space.
Per-farm autonomy dial
A farm can run with the assistant in suggest-only mode, while another uses auto for routine tasks.
Autonomy dial
Three settings. The floor stays the same.
Per farm, per user role. You can change it whenever. The safety floor never moves.
Suggest
The most conservative.
The assistant answers questions and surfaces recommendations. It never proposes a draft.
Draft
Recommended for most farms.
The assistant can propose records, but you approve every one. This is the default.
Auto
For routine, reversible ops.
The assistant can post low-risk records (notes, reminders, water logs) without confirmation. Money stays gated.
Auditability
Every write leaves a paper trail.
Money, inventory, and livestock changes are logged with who, what, when, why, and from where. Query it from the app, export it anytime, hand it to the auditor.
- Append-only audit_events table
- Before / after diffs on every change
- Source field: web, mobile, AI, webhook, API
- Exportable as JSON
| actor | User, role, IP, device |
| before / after | Diff of the affected row |
| source | UI · mobile · assistant · API · webhook |
| reason | Free text when rejecting a draft |
| reversible | True for soft fields, blocked for hard deletes |
Operator controls
Everything you need to feel in control.
Kill switch
Disable the assistant for a farm in one tap. Affects every user immediately.
Live activity
See what the assistant is doing right now, in plain English, on a single screen.
Role-aware UI
Workers see their tasks. Managers see recommendations. Owners see everything.
Exportable history
Every audit row, queryable and exportable. Your data, your evidence.
Re-auth on sensitive ops
Sales, expenses, role changes — re-enter password to confirm.
Multi-farm isolation
Owners with multiple farms get clear, separated contexts. No accidental cross-posting.
The simplest summary we can give you.
The AI is a junior operations analyst who can read your books, draft a record, and explain their reasoning. It cannot post anything to your books without your tap. That's the whole design.
Walk a real farm in 60 seconds.
The demo loads a real Nigerian farm with live insights, feed runway, money, and a chat with our AI. You'll know if FarmOps is right for you before you sign up.