Service 04
AI that cannot quietly invent your numbers.
A confident wrong answer is worse than an honest gap. Every guardrail we ship is named after the incident that produced it.
- Tiers
- 03
- Agents deployed
- 04
- Cost per full pass
- $1 to $2
01The three tiers
Most teams only know the middle one
Where the model runs changes what it can do, what it costs and what can go wrong. Pick the tier before picking the tool.
- A
Conversational agents
The model runs on an agent platform and your team talks to it. Reads run freely. Every write is wrapped in a required confirmation, so the user gets an approve button and nothing lands without it.
- B
Model in the platform
Called from Apex through a named credential. The key is never an Apex value. Output is validated before it is stored, and anything failing validation is dropped rather than written.
- C
Model in the pipeline
A worker outside Salesforce, used when the platform is the wrong place. Apex cannot sleep, cannot honour a retry-after, and has a 120-second callout budget. Those three facts decide the tier.
02The prompt envelope
Everything a user typed is data. Never an instruction.
This is the part that decides whether an agent is safe to put in front of a customer. A record field is text somebody else controls, and a model reads it in the same voice as the system prompt unless you stop it.
- Every user-editable field is truncated, stripped of angle brackets and control characters, then wrapped in a data envelope.
- The system prompt ends by naming that envelope as untrusted record data.
- The key is a named credential password merged into a header. It never becomes an Apex value, so it cannot be logged or echoed back.
- Output is validated before it is stored. Enumerations allow-listed, scores range-checked, arrays capped, strings length-capped.
- Anything failing validation is dropped rather than written. An unlabelled claim is recorded as general model knowledge, because the weaker claim is the safer default.
Three of this account’s four open orders are past their scheduled end date with no billing window set. The pattern matches two orders that later needed a change request.
Generated from order records in this org. Not a measurement. Users cannot edit this text.
Ask us whether your idea should use a model at all.
03Guardrails
Each one named after the incident that produced it
Six rules we did not invent in a workshop. Every one exists because something went wrong first.
- 01
Per-user identity
Every tool call carries the calling user’s own token. The platform enforces their field-level security and sharing natively. We never reimplement permissions.
- 02
Fail-closed tokens
A token is never sourced from app-scoped state. App-scoped keys are shared by every user of the agent, so a token there would run one person’s chat as another. Token resolution raises a plain-English permission error rather than falling back.
- 03
Zero service-account custody
Exports once landed in a team-visible drive: the whole engineering team could read financial data while the person who asked got a 404. Files are now created in the requesting user’s own space, owned by them, shared with nobody.
- 04
Validated writes
An agent looping single updates once wrote a typo’d picklist value and blanked stages. Writes are now batched under one approval, with values validated server-side against the live schema and a validation rule as a backstop.
- 05
Output validation before persistence
Enumerated values are allow-listed, scores range-checked, arrays capped and strings length-capped. Anything failing is dropped, not stored. An unlabelled claim is recorded as general model knowledge, because the weaker claim is the safer default.
- 06
Prompt-injection envelopes
Every user-editable field is truncated, stripped of angle brackets and control characters, then wrapped in a data envelope. The system prompt ends by saying the envelope is untrusted record data, never instructions.
The guardrails have their own end-to-end test. It proves a write does not execute before confirmation, that approving executes it, that declining suppresses it, and that the declined change genuinely did not land. Then it deletes the test record and asserts nothing is left behind.
If the answer is a lookup or a calculation, use Apex. It is free and exact.
Use AI only for language: summarise, draft, classify the fuzzy cases. Matching campaign members to contacts by email is deterministic, so AI would add cost and error for no benefit. Selling you the no is what makes the yes credible.
You get the recommendation in writing, whichever way it goes.
05Cost reality
Measured, not projected
Figures from a live deployment against a real book of work.
You get the recommendation in writing, whichever way it goes.
Tell us what you want the AI to answer.
We will tell you whether it should be a model at all, and what the run costs. Written, within one business day.
- Reply within one business day
- Written diagnosis whether or not you hire us
- Vancouver, British Columbia