Hospitality · Ordering and reservations chat assistant
A chat assistant trusted to take orders, bookings and payment across every site.
A restaurant group operating across many sites moved ordering and reservations into an LLM-powered chat assistant: guests order, book and pay in a conversation, with no staff in the loop. The group needed evidence it would charge the right amount, promise only what the kitchen could deliver, and never be talked into giving away tables or money.
Sector
Hospitality (multi-site restaurant group)
System
Guest-facing ordering and reservations chat assistant with menu, point-of-sale, reservations and payment integrations
Engagement
AI Red Team and AI Assurance Assessment
Timeline
Six-week engagement; continuous assurance since
The situation
Every order a conversation. No one listening in.
Phone lines and a booking widget had become a chat window. Guests described what they wanted in their own words; the assistant built the order from the live menu, took payment, confirmed the booking and sent it to the right site. It was faster than the old way and guests liked it. By launch it was handling a meaningful share of orders at the busiest sites.
What worried the operations director was not whether it worked. It was what it would agree to. A guest who wants a discount, a competitor who wants the tables gone on a Saturday night, someone with a serious allergy asking a question the menu data cannot answer: every one of those is a conversation the assistant would have alone. The group asked us to have those conversations first.
What we found
It was helpful. Helpfulness was the attack surface.
Prices and discounts could be negotiated
The assistant computed order totals itself and stated them to the guest before passing the order to the point of sale. Asked persistently, it applied discounts that did not exist and honoured prices the guest invented. Three distinct routes produced an order the kitchen would make for less than it cost.
Allergen answers were confident, not grounded
Menu data recorded allergens for most dishes but not all. Where it was missing, the assistant answered anyway, in the same assured tone, and in a measured share of cases told a guest a dish was safe when the data did not say so.
Bookings could be found and cancelled by name
The reservations tool looked up bookings by the name and phone number given in the chat, not by any verified identity. Testers cancelled and moved other guests' reservations, and could hold every table at a site for a Saturday evening in under an hour.
Special requests reached the kitchen as instructions
Free-text order notes were printed to kitchen tickets and surfaced in staff-facing tools unfiltered. Text placed in a note could change how the assistant described the order to staff, and appeared on tickets as if it came from the business.
What changed
Keep the conversation. Take away the authority.
The assistant kept its voice and lost the ability to decide prices, promise safety or touch a booking it could not prove was yours. The group launched it across every site, unsupervised, with the evidence to back that decision.
- Order totals, pricing and discounts moved to the point of sale; the assistant quotes what the system returns and cannot alter it
- Allergen responses restricted to recorded data - where it is missing, the assistant says so and routes the guest to the site; tested against a guest-language allergen set built with the group's chefs
- Reservation lookup and changes bound to a verified contact (a one-time code to the booking's phone number), with per-contact and per-site booking limits
- Order notes treated as untrusted content: isolated from the assistant's instructions and sanitised before reaching kitchen tickets and staff tools
- Payment confirmations and guest contact details minimised in the conversation context and excluded from conversation logs
- A reproducible attack suite covering every validated path, handed to the group's technology team
Ongoing assurance
Menus change weekly. So does the model.
Menus, prices and allergen data change every week, often per site, and the model and prompts change underneath them. Every menu release and every model or prompt change runs through the pricing, allergen and booking suites before guests see it. When a seasonal menu was loaded with incomplete allergen data this year, the suite flagged it before the assistant could answer a single guest about it.
We re-run the adversarial suite each quarter and ahead of the group's busiest periods; the technology team runs the regression set in its own pipeline in between.
How continuous assurance worksMore case studies
All case studiesBegin with evidence