Alarm company software with AI: paperwork in reach, panels out of reach.

A security installer sells two things at once: devices on the walls and a promise that somebody acts when one of them trips. The paperwork around the devices is ordinary back-office work. A survey becomes a proposal, a sale needs the right cancellation notice, a city may want a permit before the system is used, and an install needs every part on the van. The promise runs through a monitoring platform, a central-station account, panel programming, user codes and camera feeds, and none of that is paperwork.

Supervised AI assistants can prepare much of the first part: proposal drafts, permit research and tracking, install sequencing. They should have no access to the second part at all, not read-only, not with an approval, not for one task. This page sets out where that line falls, why the way Grok Bot is built makes it absolute rather than a matter of settings, and which decisions stay with the licensed people in the business. It is the security and smart-home guide in Aevrion's home-service industries series.

Before asking what an assistant could do, list every system the company signs in to and sort each one. The paperwork column holds what describes the business: the proposal template and price book, the agreement files, the job schedule, the parts sheet, the permit tracker and the invoices. The protection column holds whatever can change whether a home is protected, or who sees inside it: the monitoring platform and the dealer's central-station account, the panel programming tool and any remote access to panels, the customers' alarm and smart-home apps, camera and video-doorbell feeds, and every list of codes, passcodes and call contacts.

The test for the protection column is plain. If a mistake in that system could leave a house unprotected, send a response to the wrong place, or show a stranger the inside of a customer's home, it belongs there. Smart-home work makes the column longer, because a lock, a garage-door controller or a thermostat on the same app as the alarm carries the same exposure as the alarm itself.

In Grok Bot, each assistant is a Bot: a named teammate with one job and a conversation of its own. Each one works on a cloud computer that persists between jobs, with a web browser, files and a command line. The documentation is direct about that computer. Every Bot on an account uses the same one, the files, browser sessions and command-line credentials on it are available across the whole roster, and users are told not to treat separate Bots as a security boundary.

For an alarm dealer that settles the design. If the monitoring portal were signed in on that computer for one Bot, every Bot on the account could reach the session. A lasting rule telling a Bot never to open the monitoring site is guidance to the Bot, not a technical control. An approval card does not close the gap either: the documentation says an approval governs a proposed action and does not reverse work already done, and a card raised by a routine, which runs without the owner, lapses after roughly ten minutes (Cursor's help pages say thirty) and its action does not run. So the protection column is never signed in on the Bots' computer, nothing from it goes into the shared workspace folder, and codes, passcodes and zone maps are never typed into a conversation.

The documentation does offer one way to keep credentials apart: give work that needs a separate computer and credential set a separate user account. That suits, for example, keeping a bookkeeping login away from the proposal work. It is not a way back into the protection column. For monitoring, panel programming, codes and feeds, the answer in this design is no assistant on any account.

Based on the Grok Bot documentation at docs.x.ai as checked on 15 October 2026. Its statements on Bot rules, Bot-to-Bot messaging, routine triggers, connected apps, approval expiry and payments were rechecked against docs.x.ai and Cursor's help pages on 26 October 2026. The trade examples are Aevrion's illustrations, not documented Grok Bot use cases. Aevrion Ops is an independent consultancy. It is not affiliated with, endorsed by or a partner of xAI, SpaceXSI or Cursor. Grok Bot is named here only to describe it.

The site survey gathers the raw material: the doors and windows to cover, the glass, the rooms where motion detection works around the pets, the camera positions the homeowner wants, the panel location, the Wi-Fi and cellular conditions, and whether the customer wants professional monitoring or self-monitoring. A Proposal Bot, set up by the owner following Aevrion's pattern, drafts from a summary the surveyor writes for it: device types and quantities, the monitoring plan, labor, terms and options. It reads every price from the owner's price book on every draft, since the documentation does not treat a Bot's memory as an authoritative record.

What the summary leaves out is the security picture: which entry is uncovered today, where the cameras cannot see, the floor plan, the panel's hiding place. That belongs to the system design, which the owner or the designer decides, and it stays in the dealer's own job system. Consider a homeowner with an older wired panel who wants a video doorbell, two outdoor cameras and smart locks. In this illustration the draft sets out two options side by side, taking over the existing panel or replacing it, with the device list, monitoring plan and labor for each and a note of every question the summary left open. The owner decides what to recommend, checks the prices and presents it.

When an alarm system is sold at the customer's kitchen table, the sale can fall under the FTC's Cooling-Off Rule, 16 CFR Part 429. As checked on 15 October 2026, the rule covers sales of consumer goods or services made at the buyer's home for twenty-five dollars or more, including visits the buyer invited; the buyer can cancel until midnight of the third business day; and the seller must hand over a completed contract or receipt carrying the cancellation statement, with the notice of cancellation in duplicate. A visit the buyer asked for to repair or maintain their own property is excluded, but extra goods or services sold during that visit are not. The rule does not displace state laws that give buyers equal or greater rights.

For an assistant this is a checklist, not a judgment. It can confirm that each in-home agreement file holds the statement and both copies of the notice, and flag an install booked inside the cancellation window so the owner can decide how to handle it. Whether the rule covers a particular sale, and which state rule applies on top, is for the owner to settle with a lawyer. The bathroom guide on in-home sale paperwork in this series sets out the packet check line by line.

In California, alarm company operators are licensed by the Bureau of Security and Investigative Services (BSIS). They are businesses that sell alarm systems at the buyer's home or business, or install, monitor, maintain, service or respond to them. The company names a qualified manager, who must pass the licensing examination and show two years of paid experience in alarm company work, or the equivalent. The employees who do that work register as alarm agents after a criminal history check run through both the FBI and California's Department of Justice. The bureau's fact sheet, dated January 2022, adds that local authorities may require an alarm company to register locally and hold a local operating permit, may pass false-alarm ordinances, and may require alarm users to obtain permits (as checked on 15 October 2026).

None of that can be delegated, and an assistant never states that anyone is licensed. It can hold the dates the owner enters from the bureau's own records, such as each agent's registration status, and flag an install booked with a technician the owner has marked as pending. Licensing differs from state to state; outside California the owner checks the requirements with that state's licensing body.

Cities and counties may regulate alarm users through their own ordinances, and the Security Industry Alarm Coalition (SIAC) publishes a model ordinance for them to adapt. It is a model, not law. In its February 2020 revision, nobody may use an alarm system without first obtaining a permit, each permit has a unique number, the user gives that number to the alarm company, and the company passes it to the police communications center to help dispatch (as checked on 15 October 2026). The same model defines the monitoring company's two-attempt Enhanced Call Confirmation, which the permits guide covers.

Each jurisdiction writes its own version, so a Permits Bot researches every install address against the city's or county's published pages and keeps the status in the tracker. The permits and false-alarm guide in this series sets out that lookup, the tracker fields and the handling of false-alarm letters.

Installs slip on small things: a device missing from the van, a permit number that has not come back, a homeowner who cannot be in for the user training. A Schedule Bot can work from the job list and the parts sheet to draft each week's sequence for the owner, showing which jobs have every device in stock, which are waiting on a permit number, and which need the customer at home. It drafts confirmation emails as well; the documentation describes these as editable drafts the user reviews and then sends or discards.

The draft stops at the van door. Mounting, wiring and pairing devices, programming the panel, opening the monitoring account, sending test signals and training the user are the technicians' work, and a person records each one in the job system. The two-technician week in this series follows five installs across that split.

Start small, the documentation advises: the smallest useful roster, with a new Bot only for a distinct goal, tool set or approval rule. For an alarm dealer that is three: Proposal, Permits and Schedule. Permits is the one that suits a routine, such as a weekly run that reads the tracker for permits still pending or due for renewal and drafts a note for the owner. The weekly run lists and drafts; it never applies, pays or signs anything.

There is no fourth Bot for monitoring, no Bot for camera support, and no Bot that holds a customer's app login. Where a city permit portal needs a login, the owner enters it through the documentation's take-over step rather than in chat, and it then sits on the shared computer. That is acceptable only for a site every Bot could safely reach.

Each item turns on the license, the customer's safety or the customer's privacy.

• SYSTEM DESIGN

  Which devices go where, and what the system protects against, is decided by the owner or the designer.

• THE AGREEMENT

  Proposals, monitoring agreements and cancellation handling are approved by the owner.

• PROGRAMMING

  Panel settings, zones and every user code are set by a technician, outside any assistant's reach.

• MONITORING

  The central-station account, call lists and passcodes are handled by people on their own devices.

• CAMERAS

  Live and recorded video, and who may view it, stay between the customer and the people they authorize.

• PERMITS

  Applications are made by whoever the ordinance names, and permit numbers are entered by a person.

• FALSE ALARMS

  What caused an alarm, and whether to contest a city's letter, is for the technician and the customer.

• CUSTOMER MESSAGES

  A draft reaches a customer only when the owner sends it.

Start with a sheet of every system the company signs in to, sorted into the paperwork and protection columns above, with a note of whose device holds each login today. If a protection-column login sits on a shared office computer or in a shared password note, fix that first, with or without assistants. Then pick the paperwork task that costs the most evenings, whether proposals, permits or the install plan.

From there, a scoping conversation through the contact page is the next step. Aevrion Ops can map the two columns with you, design the three Bots and the lasting rules each is given, and build custom integrations to your job system or price book where each vendor's API or terms permit, once they have been tested. If you would rather test one workflow on your own first, the free readiness assessment scores it against twelve fixed dimensions and returns a result straight away; score permit tracking, and expect ownership clarity to come out low if nobody owns the permit numbers today.

1. An alarm business runs two kinds of system: paperwork that assistants can help prepare, and protection systems that no assistant touches.
2. All Bots on an account share one computer and its sessions, so a monitoring login there would be open to every Bot; it is never signed in.
3. Proposal drafts list devices, monitoring plans and labor from the owner's price book, and leave the security picture in the dealer's own system.
4. In-home sales can fall under the FTC's Cooling-Off Rule; an assistant checks the file for the statement and both notices, and the owner decides.
5. California licenses alarm company operators and registers alarm agents; an assistant holds dates from the bureau's records and never vouches for a license.
6. Start with three Bots, Proposal, Permits and Schedule, and no Bot on the protection side.