What an AI chief of staff never does
Opitor is an AI-native operating system for small companies, where every person gets their own AI chief of staff. Most writing about a thing like that describes what it can do. This is the other list.
The list matters more than it looks. In a small company the decision to use something like this is not made by a procurement committee over three months. It is made by one person, in an afternoon, on the basis of whether they believe it will behave. What a system refuses to do is the part of that belief you can actually check.
Four things, each a rule rather than a preference you configure.
It never sends as you
It drafts. You send. There is no mode, permission, or setting in which a message leaves under your name because you were not paying attention.
This is the limit people underrate, because the alternative sounds so convenient. Something that can reply for you saves more time than something that can only suggest a reply. The saving is real. The cost is that you now live in a company where a message from a colleague might not be from that colleague, and there is no way to tell which is which.
That cost falls hardest at exactly this size. In a ten-person company a message from the founder carries weight because it came from the founder, and once people start reading everything with a small question attached — did she write this, or did it write this — you cannot undo it.
So the rule is narrow and absolute. Drafting is where the help is: it reads the thread, it knows what you already said, it writes the reply you were going to write, and getting from nothing to a good draft is most of the work. Then it stops and waits for you.
The second half of the rule points the other way. Everything the chief of staff writes is signed in purple, so when it writes something you can see that it wrote it.
It never gives an administrator a way into your private messages
Your private messages are private, including from the person who runs the company.
There is no administrator override. Not a break-glass procedure, not an export, not a compliance mode that turns it on for a quarter. It is stated this flatly because partial versions of the promise are worth nothing. “Private, unless” is functionally the same as “not private”, because nobody can tell from the inside which day the “unless” applies.
The practical consequence is about what people are willing to say. Every company has a set of conversations that are genuinely useful and slightly uncomfortable: this is not working, I think we are wrong about the customer, I am struggling. Those conversations happen somewhere. If they cannot happen in the company’s own tool, they happen in a personal channel that nobody can see, including the people who would benefit from hearing them.
A founder reading this might notice that the rule constrains them specifically, and that is the point. It is a constraint you accept in exchange for a company where the hard conversation happens in the open rather than three tools away.
It never keeps what you did not confirm
Anything that works alongside you accumulates a picture of you. The question is not whether it has a memory. It is who holds the pen.
Here it works one way. After a conversation, your chief of staff proposes what it thinks is worth keeping. That proposal is a suggestion and nothing more: nothing is used until you confirm it.
Three things follow from that, and each one is checkable rather than a matter of trust.
You are shown what it wants to remember, at the moment it wants to remember it, rather than discovering it months later in a summary you did not expect. You can see the whole of what it holds, as a list, not as a search box that returns what it decides to return. And you can delete any of it, with deletion meaning the entry is gone rather than hidden.
The reason this is a rule and not a setting is that a memory you were never shown cannot be corrected. The other two abilities are worth very little without the first one: seeing a list you did not write is not review, and deleting from a list you did not know existed is not control.
It never replaces the person
A chief of staff in a real company does not do your job. They read along so that they know what is happening, they follow up the things that were supposed to happen, they prepare the material, and they draft. The person still decides, still shows up, still owns the outcome. That shape is deliberate, and Opitor keeps it.
So what it does is bounded. It gathers your messages. It follows up your todos and deadlines. It keeps the company’s quarterly goals in view. It advises and drafts. What it does not do is take the meeting, make the call, own the relationship, or decide what the company should do next.
This is not modesty about what the technology could attempt. It is a claim about what is useful. Work in a small company is mostly judgement applied to incomplete information about specific people, and the part that can be handed off is the part around it: the remembering, the chasing, the first version of the text. Handing off that part is a large saving. Handing off the judgement is how a company stops knowing why it does things.
Why the nevers are what make it usable
Put the four together and the limits turn out to be the reason a small company can adopt this at all.
A company of ten has no security team, no policy review, and nobody whose job is to work out what a tool does with your data. The whole evaluation is one person’s judgement, formed quickly. Under those conditions, capability is not what makes a decision easy. Predictability is. Four rules that hold everywhere, with no exceptions to look up, can be understood in a minute and relied on afterwards.
What it means to be the first person using it
You do not have to move a company to find out whether any of this is true. One person can start alone and invite the team when they are ready. That is the same product, working for one person, and it is enough to check every claim on this page yourself.
Watch whether anything goes out that you did not send. Look at what it asked to remember and whether that list matches what you agreed to. Delete something and see whether it comes back. Four rules are few enough to verify in a week of ordinary work, which is about how long it should take before anybody else sees it.
Where Opitor fits
Opitor is an AI-native operating system for small companies, where every person gets their own AI chief of staff. The four rules on this page are how it works: it drafts and you send, everything it writes is signed in purple, administrators have no override into private messages, and memory is proposed after a conversation and used only once you confirm it, with everything visible and deletable. Messages, the Todo List and its deadlines, and the company’s quarterly goals (OKR) managed by administrators are the parts it works across. It is free to start, with no paid plans yet, it runs on its own servers, and it works in a phone browser. There is more on what is an AI chief of staff and on the questions and answers page.