Guarded assistants
Guarded assistants, completed and retired
A leasing chat agent for a commercial property listing and an assistant for a non-technical user, each limited by the tools it was given. Both finished their jobs and were retired.
How it fits together
Inputs
Prospective tenants
Visitors to the listing site ask about the space.
A non-technical user
Large text and tap-to-choose option cards, so the assistant never depends on typing.
Engine
The tool list is the guardrail
Each assistant can only do what its short, fixed set of tools allows.
Answer from the facts
The leasing agent may not invent features or rates or negotiate terms, and hands off to a person when its knowledge base has no answer.
Capture the lead
A single typed tool records an interested tenant, within a small cap on steps per conversation.
Stop and escalate
The assistant has a dedicated tool for handing a question to people instead of acting on it.
Outputs
Qualified leads
Authenticated, cleaned, and rate-limited before anything is stored or emailed.
Approved changes
Anything the assistant proposes waits for a person to approve it in Telegram.
Telegram
Guardrails
- No tool can touch money, accounts, credentials, or outside sites
- A scoped database role that cannot delete
- Approvals guarded against sending twice
The problem
Some assistants talk to the public, and some serve people who will trust whatever the assistant says. In both cases the safe design is not a longer prompt. It is an assistant that cannot take a harmful action because it was never given a tool that could.
What I built
- A streaming leasing chat agent on a single-property listing site that answered from the property's documents, captured leads through one typed tool, and handed off when it did not know.
- A lead path behind header authentication that normalized and length-capped every field and limited how many leads could arrive in an hour.
- An assistant for a non-technical user with a fixed, short tool list, a tool for escalating to people, and approval of its proposals through Telegram.
- A database role scoped to what the assistant needs, with no delete or schema rights, and archived items hidden rather than removed.
How I built it
The leasing agent ran on Next.js with an OpenAI model through the Vercel AI SDK. The assistant ran on Claude, with a small cached core prompt plus one module for the active topic. Both projects were completed and shut down when their purpose was met, and the listing site was kept as a static replay of the agent.
What it shows
I limit what an agent can do before I tune what it says, and I retire systems cleanly when the job is done.