Blog

The tutor that is not allowed to answer

An AI assistant that hands a stuck beginner the working solution has destroyed the exercise it was supposed to help with. The fix is not a politeness instruction. It is a system prompt with a four-level scaffold, a hard cap on how much code the model may emit, a ban on revealing hidden tests — and the student's own failing test results in context, so the assistant diagnoses instead of guesses.

The question you must not let a model answer

Most questions to a nonprofit's assistant deserve a retrieved, generated answer. A small number do not: someone saying they are not safe needs the same correct response every time, not a probable one. So recognized urgent phrases are matched before retrieval and before generation, and return a fixed reply with emergency contacts. Everything else goes to the RAG path — four datasets, reranked, answered at temperature zero.

Authority that is field-level, not record-level

In a university approval chain a dean may edit some attributes of a course a department proposed, but not others. Role-per-record permissions cannot express that, and neither can a spreadsheet. The design that works treats approval state as a seven-state lifecycle, keeps authorization in one module both the UI and the API read from, and re-checks authority inside the transaction that writes — so a decision made against a stale screen fails loudly instead of overwriting someone else's.

Permissions you cannot forget to apply

A role check you have to remember to write is a defect waiting for a busy afternoon. On a platform holding records of minors, the permission model was reduced to three primitives — one for the UI, one for mutations, and one that returns the predicate every list query must apply. Migrating pages onto the third surfaced two real cross-tenant defects that role-only checks had hidden.

Shared ink that is never peer-to-peer

When a teacher draws on a shared coursebook page in a live lesson, the fast implementation broadcasts the stroke to every peer. That produces a classroom where what is on screen and what is saved can disagree, and where the student who joins late sees a blank page. The stroke goes to the database first and is broadcast by the server; only the ephemeral signals — viewport, pointer — travel the cheap path, and the receiver checks who sent them.

The confidence gate: automate the reading, not the deciding

A confidence gate is the rule set that decides whether a language model's extraction is allowed to reach a customer without a human. Automate the reading — classification and extraction — and keep a person on the deciding. Anything below the gate still gets acknowledged, then queued with the reason it was held.

Long-term memory that isn't a chat transcript

Storing conversations is not memory. In a care platform for families raising autistic children, memory is three separate tables — what happened, what is generally true, and what has actually worked — with a scheduled job promoting events into patterns, effectiveness computed as arithmetic rather than model opinion, and every answer citing the family's own record.

Natural-language queries without opening your database

Letting recruiters ask questions in plain Turkish means letting a model write SQL against a multi-tenant database. The safety is not in the prompt — it is in a guardrail layer between generation and execution: an allow-listed schema, a forced LIMIT, rejected mutations, and a tenant filter bound as a parameter the model never sees.