Brand voice needs four separate layers because one system prompt cannot handle identity rules, situational context, expressive style, and output checking at the same time.
2
A post-generation veto must check facts and forbidden outputs against real data before a response reaches the user.
3
In a multi-tenant system, brand identity must never have a silent default. Missing identity should cause a loud failure instead of sending another venue's voice.
Summary
Isadora Martin-Dye argues that brand voice is an architecture rather than a tone instruction added to one system prompt. Her four layers are immutable identity rules, situational mode, example-anchored voice, and a post-generation veto. Identity rules cover facts the AI must never violate, such as disclosing that it is AI or avoiding claims that it has a physical body. Situational mode changes the response for the user's role and circumstances. Examples teach warmth and phrasing, but they only cover expected cases. The veto reads the generated text and can flag or reject it when it invents a date, number, or other damaging claim. Martin-Dye applies the same structure across wedding venues, a personal AI companion, and Thread Light, a tool for families of missing people. She is candid about unfinished parts of the design, including manually selected modes and vetoes that should become a shared service.
A single tone prompt breaks when the user leaves the happy path
Martin-Dye says a detailed system prompt with brand guidance and examples works for anticipated questions, then often fails around an unanticipated turn. She calls this the turn 21 problem: the model produces something technically correct that the brand would never say. This matters for products where the relationship is part of what customers buy, such as luxury hotels, high-end real estate firms, and wedding venues. A sentence that sounds slightly wrong can cost more than a refund because users notice whether the business understands the relationship they are paying for. The instruction "Write in our brand's voice" does not add much control by itself.
The architecture separates four jobs that prompts usually mix together
The proposed stack has four layers. Immutable identity contains rules the brand structurally cannot break. Situational mode adjusts for the user's role, circumstances, and current conditions. Example-anchored voice supplies warmth, phrases, and tone controls. The post-generation veto checks the response after it has been produced. Martin-Dye previously had 24 system prompts scattered through the codebase, with different surfaces having different ideas about the AI's identity. She replaced that arrangement with one assembly point and a fixed order. Hard rules come first, and the task comes last, because conditions need to be loaded before the model chooses how to respond.
Immutable identity prevents warm language from becoming a lie
Layer one contains constraints that nothing below it can override. In The Bloom House AI, every assistant discloses that it is AI in its first response. If asked whether it is a human, bot, or live agent, it must answer clearly that it is an AI assistant. Another rule forbids claiming physical presence. The AI cannot say, "I'd love to show you around" or "I can't wait to meet you in person." It can say that the team would love to host someone for a tour. Martin-Dye treats these as product decisions about trust, rather than a compliance checklist. Warmth cannot justify a claim about a body the software does not have.
The same hard-rule layer carries more serious limits in Thread Light
Thread Light uses the same architecture for a very different audience, families of missing people. Its first layer forbids words such as "confirmed," "identified," "matched," "proven," "linked," and "solved." A model may reach for "matched" because it is statistically natural, but that word can tell a grieving person that their child has been found when the evidence does not support it. Martin-Dye contrasts this with the wedding venue example, where a physical-presence claim is embarrassing and damaging to trust. In Thread Light, an unsupported status word can cause far greater harm. The rule therefore has to live below the voice layer, where warmth or confidence cannot override it.
Situational mode changes the response without changing the assistant's identity
Layer two loads real-time conditions before the model runs. The same AI may talk to couples and brief venue coordinators, but the audience changes the route. A coordinator asking whether inquiries will increase in June can receive an uncertain forecast with a trend and possible range. A couple should not be addressed with that same detached briefing style. The layer also uses soft context notes about a person's situation. Those notes guide tone and what to avoid, but the AI must not quote them directly. Martin-Dye gives the example of a couple with a parent in chemotherapy. If engagement drops, the system should read that as a family under strain when the context supports it, rather than as a cold lead to chase.
Examples teach style, but they cannot guarantee behavior
Layer three is the tone guide, including dials, phrase lists, and examples of good writing. Martin-Dye compares it to an intern's induction pack. It teaches what good looks like on the happy path, and Bloom also lets coordinators edit real AI responses so the system can learn from those edits. However, examples cannot enforce an inviolable rule, load personal context, or inspect an answer after generation. They have nothing to say when a user asks something the examples never covered. Martin-Dye describes that as a catch-all problem rather than a failure of the examples. They were never the right tool for guarantees.
The post-generation veto catches confident claims that prompts miss
Layer four is the only part that reads the actual output. It has a soft flag for issues such as failing to answer the question and a hard reject for expensive failures, including invented numbers or privacy violations. Martin-Dye added it after the AI repeatedly offered clients dates that were already booked. The model had the right identity, mode, and voice, but it did not have the calendar. A warm offer to hold an unavailable Saturday created a delayed disappointment. The veto checks generated specifics against real data, such as an allow list of dates, and prevents the response from shipping. The first three layers ask the model to do something. The fourth decides whether the result has permission to leave the business.
Multi-tenant identity must fail loudly when configuration is missing
The stack supports different venues and products through shared logic with per-tenant conditions and voice settings. Martin-Dye describes a white-label failure in which missing brand fields silently defaulted every venue to the same identity, such as sage@hawthornemanner.com. The fix is to load identity from the venue AI configuration and throw an error when it is absent. A missing identity is a crash, not a fallback. Otherwise, a venue can speak in another venue's voice while the user has no clear explanation for why the response feels wrong. She also says the veto should become a shared service that every surface passes through automatically, and that a central condition resolver should replace manual mode selection.
"I'm not programming a robot, I'm managing a brilliant intern with an incredibly high IQ and a terrible EQ."00:00
Who should watch
You are building an AI product where customers care about the relationship, tone, or emotional handling as much as the answer itself.
Your system prompt produces plausible responses but sometimes invents dates, numbers, policies, or promises that users may act on.
You run several tenants or product surfaces and need a shared identity and safety structure without copying separate prompts across the codebase.
