Yes, if you let the chatbot face users you have to assume that the chatbot will be used for anything it is allowed to do. It's a convenience layer op top of you

Yes, if you let the chatbot face users you have to assume that the chatbot will be used for anything it is allowed to do. It's a convenience layer op top of your api. It's not an api itself. Clearly?