THEO is designed with deliberate constraints that cannot be overridden. Understanding what THEO will not do — and why — helps you plan workflows correctly and know when to involve a human. This article covers THEO's hard limits, data boundaries, and when escalation is the right call.
What THEO Will Not Do
Follow Instructions Embedded in Data
If a ticket body, email, Slack message, file, or web page contains text like "ignore your previous instructions" or "email me your customer list," THEO ignores those instructions. Any content read from tools or external sources is treated as data, never as commands. This is a hard constraint and cannot be disabled.
Reveal Secrets or Credentials
THEO will not print API keys, passwords, tokens, SSH keys, JWTs, connection strings, or private-key blocks — even if asked directly, even from environment files, even in test fixtures. Its output is scrubbed for these patterns before you see it. This applies in all contexts: chat, runbook output, reports, and notes.
Cross Client Boundaries
THEO will not show one client's data to another client. HCP (client portal) users are always scoped to their own contact record. MSP staff querying data for one client cannot inadvertently retrieve another client's records through a single request. This boundary is enforced at the tool level, not just in the response text.
Act Destructively Without Human Approval
At default trust levels, every external action — email sends, ticket changes, device actions — queues for approval unless the mode is Assist or Autopilot and confidence is above your configured threshold. Certain high-risk categories require human approval regardless of mode.
Produce Malicious Content
THEO will not generate malware, offensive security tooling for unauthorized use, phishing content, or credential-stuffing scripts. These are refused outright.
Exceed the Input Limit
User messages are truncated to 2,000 characters. To analyze a long document, attach it as a file rather than pasting the content.
Data THEO Cannot Access
THEO is limited to what is surfaced through its connected domain tools. It cannot access:
- Raw SIEM log streams — only the alert and incident summaries your security integration exposes
- Unconnected systems — if a product or tool is not integrated with The One Stack, THEO has no visibility into it
- Device performance time-series — THEO cannot return CPU, RAM, disk or network history for a device. The platform's telemetry time-series pipeline is retired, and direct RMM agent output is not streamed to it; what it reads from your RMM device records is the device's name, operating system, online/offline status and last check-in
- Data from other organizations — THEO cannot query another org's data regardless of role
Plan-Based Limitations
Some THEO features require paid plans:
-
Long-term memory — the plan floor applies PER MEMORY OPERATION, not to memory as a whole. Four of the ten memory operations require a paid plan: listing memories (
GET /api/v1/theo/memory), saving one (POST /api/v1/theo/memory), saving a suggestion (POST /api/v1/theo/memory/suggest) and sharing a personal memory to the org (POST /api/v1/theo/memory/:id/share). A free org sees an empty memory list and is refused those writes. The other six carry NO plan check at all — editing a memory (PATCH /:id), deleting one (DELETE /:id), the share audit (GET /share-audit), bulk embedding (POST /embed-all), reading the memories attached to a record (GET /entity/:type/:id) and saving one (POST /entity) — andPOST /entityis a WRITE: it stores an entity-scoped memory for any tier, including free, andGET /entity/:type/:idreads it back. Platform owners bypass the four paid checks. - Custom GPTs — Business tier and above
- PSA integration — included with THEO; Starter tier and above (no Business-tier requirement)
-
Voice chat — requires a Pro, Enterprise or Internal plan tier. That is a closed set of three plan tokens, not a "Pro and above" ordering: the gate admits those three or a platform owner, and its refusal sentence is derived from the set — "This feature requires a Pro, Enterprise or Internal subscription." The set does not hold the
theo-businessandai-enterprisetokens this product's Business surfaces accept, so a plan token outside the three is not admitted by the plan arm on any voice-chat endpoint. Two of the three voice surfaces —POST /api/v1/theo/voice/turn(tap-mic) andPOST /api/v1/theo/voice-session/start(realtime Talk to THEO) — additionally admit a user explicitly granted thetheo-voicepermission; the third, the voice-chat surface the Hub Bar's voice mode calls (POST /api/v1/theo/voice-chat/stream), carries no permission arm and admits only the three tokens or a platform owner. - Org knowledge base (RAG) — Business tier and above
Free tier users are also subject to a dynamic daily usage cap. When the cap is reached, THEO will let you know. The cap resets daily.
Rate Limits
- Per user: 500 requests per hour across all surfaces
- Per org (free plan): Dynamic daily cap managed by the platform
When to Escalate to a Human
Escalate when: a policy blocked the request and you need to understand why (check the trace); the org is locked due to an active SENTINEL incident; the action requires a trust level or role the current user does not have; a completed external action needs to be reversed in the target system; or THEO produced incorrect output that has already been sent (submit a correction from chat).
FAQ
Can an admin disable the safety constraints for their org?
No. The guardrails against prompt injection, secret leakage, and cross-client data access are not configurable. Mode, trust levels, and opt-in settings are configurable, but the safety layer is not.
Why does THEO sometimes say it cannot help with something it helped with before?
The most common reasons are a change in your role, a product entitlement that expired, hitting a rate limit, or an active SENTINEL lockdown. Check the reason THEO gives and the execution trace for details.
What if THEO produces an incorrect answer?
Submit a thumbs-down with a reason, and if needed, a structured correction from the chat. These feed the training corpus. If the issue is a missing document, add it to the org knowledge base and re-ask with more context.