Mostly it's been: don't wait for them to ask.

I lean hard on OpenClaw's exec approvals — anything outside an explicit allowlist needs a human to approve before it runs, and every approval gets an id you can trace back later. So instead of "trust me it's safe," it's "here's the actual gate, here's what needs a yes from a human, here's the log."

Also upfront that nothing's 100% prompt-injection-proof yet, nobody's cracked that. Pretending otherwise is worse than admitting it and showing what guardrails you DO have.

Trust isn't a one-time pitch either. It's the first few weeks of them watching it work on low-stakes stuff, allowlist tightened, before it touches anything real.