One assistant that knows every business line and can never let information cross between them.
The clientA business executive managing multiple business lines that must stay legally separate.
A single assistant thread leaks context across boundaries.
Here a leak isn't a bug. It's a legal problem.
Before
- 1One chat assistant for everything
- 2Context from one business shows up in another
- 3No record of what the AI did or what it cost
- 4No way to prove it stayed inside the lines
After
- 1The human picks which agent he's talking to
- 2The database enforces the separation, row by row
- 3A second agent checks every write
- 4Every turn is logged with model, cost and latency
- 540 test prompts per agent run on every change; a failure blocks the release
The design I killed
An AI router that decided which business each message belonged to.
- Message
- →AI routerremoved
- →Business A / B / C / D
What replaced it
Deterministic routing over learned routing.
- Human picks the agent
- →Agent bound to one domain
- →Database row-level security
- →Checker agent
How I know it holds
A golden set, run on every change.
| Test family | Pass |
|---|---|
| Refusals | 100% |
| Entity fidelity | 100% |
| Coercion resistance | 100% |
Figures from production.
What it costs and how fast it is
Every turn is traced.
| Metric | Value |
|---|---|
| All-in monthly cost | ~$35 |
| Eval pass rate | 100% |
| p95 latency | 2.1 s |
| Agents under the model | ~23 |
Figures from production.
- Agents (each bound to a domain)
- →Typed dispatch messages tagged by domain
- →Postgres + pgvector under row-level security
- →Traces → dashboards → alerts at 80% of budget
No public ingress. Everything sits on a private mesh.
The human routes, and nothing is reachable from the public internet
An AI router and a public endpoint
Convenience: he can't use it from a shared or borrowed device
A leak across his businesses is a legal problem, not a bug.
- 01A second human reviewer on changes to the security files, so the golden set isn't the only gate
- 02Online evals on sampled production traffic, not just the offline suite
What this means for you
- 01The human picks the agent and the database enforces the separation, so no prompt stands between one business and another.
- 02A test set that blocks the release is how I’d want any change near a ledger to ship.
- 03Every turn is traced, so cost and speed are known rather than guessed: about $35 a month and 2.1 seconds at p95.
- 04I removed the clever component because it was a single point of failure. I’d make the same call inside a bank.
→Why not let the model route?
A single misroute crosses a legal boundary. I'll take a human click over a learned guess there.
→Is row-level security enough on its own?
No, which is why there are three layers: injected rules, the database, and typed dispatch. Any one can fail without a leak.
→What happens when an agent overspends?
Each has a monthly cap and I get an alert at 80 percent, so there's time to act before the cap.