Projects

An AI assistant that can't break anything

It answers with real ERP data, but it can't write, see personal data or run queries that slow the warehouse down.

Details

Year 2026
Outcome Read-only by design, with 55 tests
Tools Python, tool-calling LLM, PostgreSQL, Redis, pytest

How it works

  1. 1 Question in plain language
  2. 2 Tool the model picks from allowed functions
  3. 3 SQL a single validated SELECT query
  4. 4 Read-only READ ONLY transaction and capped cost
  5. 5 Masking emails, phone numbers and IBANs hidden
  6. 6 Answer as text, or a PDF or Excel report

Context

Management and operations wanted quick answers about stock, coverage, performance or the Black Friday forecast without waiting for someone to put a report together. Giving a language model access to the database had obvious risks: writing data, seeing personal data or firing off a very expensive query in the middle of a shift.

What I did

The assistant lives inside the ERP. The model can only use tools from a closed list, and when it needs data it writes a single SELECT query that runs in a read-only transaction, with its own connection pool and a least-privilege database user. Sensitive tables are blocked; emails, phone numbers and IBANs are masked by looking at the content, even if the query renames them; and every query has a cost cap. A semaphore stops several questions at once from affecting the warehouse. Answers come back as text or as a PDF or Excel report.

Outcome

It’s in beta in production for management, with 55 tests covering these limits.

What I learned

Limits belong in the database, not in the prompt. And masking by column name isn’t enough: you have to look at the content.