He did not want a chatbot. He wanted small systems that each do one job on a schedule, report to him, and never act in his name. Four of them do.
- paid model calls that skip the budget gate: the check is a mandatory preflight
- 0
- pre-send gates: a monthly report with an uncited fact cannot go out
- 8
- automated tests on the intelligence agent alone
- 633
From each system's change log, handover notes and test runs, April to September 2026. Engineering facts only: no document, task or message content appears anywhere.
US independent consultant, April to September 2026
Watch it run.
Read the narration
This back office runs a one-person consulting firm. Four small systems each do one job on a schedule, report to him, and never act in his name.
They sit around one mailbox and one drive. Each is built around one of his rules: capped AI spend, nothing sent without approval, no fact without a source, nothing deleted.
The intelligence agent watches public news and policy for his sectors. Before every paid model call, it checks the month's ledger, and over the cap, the call stops.
What matters arrives in one weekly digest. He asked for that in May 2026, in place of instant alerts. Digests and drafts go to him only.
The monitoring agent writes one cited report a month, and eight gates stop any uncited fact. It is deployed and waits on his go-ahead to send on its own.
Drop a file in the watched folder, and clean Markdown comes back with a manifest, typically in 30 to 60 seconds. The original is never changed.
The librarian proposed a structure and waited for his sign-off. Every move is journaled first, and a separate read-only pass checks each batch.
Any move can be reversed from its journal. There is no delete path.
He chose the ceiling on AI spend, and the code enforces it. Any of 27 formats becomes Markdown on his own server, and the librarian files the drive in approved, verified batches.
Before the build.
One person runs the whole firm. The constraints were the brief.
The four rules he set, before any code
A hard ceiling on monthly AI spend. Nothing sent to anyone he has not approved. No fact without a source. Nothing ever deleted.
Each of the four systems below is built around one of them, and the budget gate is the one you can watch run.
What I built.
A budget gate before every paid model call, an allowlist before every send, and a journal before every file move.
Five parts, and the third one is the one most report generators get wrong.
- An intelligence agent with a budget gate
- A monitoring agent that cannot invent a fact
- A report that is allowed to say nothing happened
- A document pipeline and a librarian that never deletes
- A daily action list
What is true today.
- The intelligence agent went live in April 2026, sent news as instant alerts from late May, and moved to a single weekly digest at the client's request on 29 May 2026; a scheduled assistant task to replace it is being set up.
- The document pipeline turns any of 27 formats into Markdown on his own server, and the librarian files the drive in approved, verified batches.
- The daily action list went live on 15 September 2026.
- Total AI spend on the intelligence agent has a ceiling he chose, and the ceiling is enforced in code rather than in a policy document.
Still open
- The monitoring agent is deployed and validated end to end, and is waiting on his go-ahead before it sends on its own.
Updated
The details, when you need them.
An intelligence agent with a budget gate
A Python service on a small server watches public news and policy sources for the sectors he advises on, scores what is material to each business area, and sends him one weekly digest instead of a stream of alerts.
A monitoring agent that cannot invent a fact
A TypeScript agent tracks one slow-moving regulatory question and produces a single cited report each month. Every citation has to map back to a finding it actually stored, every section has to be substantive, and recipients are locked to a hardcoded allowlist.
I built it in three days, deployed it under a dedicated service account, and dry-ran it end to end, emailing a real report before anything was switched on.
A report that is allowed to say nothing happened
A quiet month is the interesting case. Most report generators pad, because a report with nothing in it looks broken. This one has a separate gate profile that produces an honest report saying nothing moved.
The alternative is a system that slowly learns to make things up, and on a regulatory question that is worse than no system at all.
A document pipeline and a librarian that never deletes
Drop a file into a watched folder and get clean Markdown and a metadata manifest back, across 27 formats, with OCR for scans. The converters are pure readers, enforced by a test that fails the build if one of them ever writes.
The librarian proposed a structure for approval before touching anything, and files in journaled, reversible moves, checking its own work with a separate read-only pass after every batch.
A daily action list
At 06:00 an n8n workflow reads every work task list, one at a time after the provider throttled parallel reads, and writes one JSON feed to his file store. A scheduled assistant task reads it half an hour later and writes the day's plan.
If the feed fails, the workflow writes an explicit failed marker, so the plan can never run on stale data without saying so.
The gate inside the intelligence agent: no paid model call happens until the month's spend has been checked against its cap.
- Before every paid model call
- Runs under his own service account
- Stops at the cap, no override in code
budget-gated-model-call
Scheduled job wakes
one of 10 registered jobs
Estimate the call's cost
with a safety margin
Check the monthly ledger
hard stop before the monthly cap
Call the model
Claude
Record the cost in the ledger
Store the finding for the weekly digest
digest and drafts go to him only
Reconcile daily against provider costs
drift raises an alert
Every paid call passes the gate
What will it never do?
- A budget gate on every paid call, a provider-side spend limit behind it, and a kill switch.
- The client set the cap himself and lowered it once he could see what the agent actually cost to run.
- Silent failures get hunted down: one publisher was returning an empty page to the server, so the agent had never actually read it. I found the gap and routed around it through a public feed.
- Nothing goes to anyone he has not approved: digests and drafts go to him only, and the monitoring agent's recipients are locked to an allowlist.
- The monitoring agent's sends are latched, so hourly retries can never email the same report twice. It honours Retry-After, and a 403 escalates to a person instead of retrying.
- Every move the librarian makes is written to a journal before it happens and can be reversed. There is no delete path.
What I could not show you
- Only the four business systems built for this client appear on this page.
- Every figure is an engineering fact or a design limit. No document, task, source or message content appears anywhere.
Measurements and project details
- files deleted by the librarian: every move is journaled first and can be reversed
- 0
- to turn a 120-page PDF (a benchmark fixture) into clean Markdown
- 1.37 s
- from dropping a file in to getting clean Markdown back
- 30 to 60 s
- Client
- US independent consultant
- Industry
- Professional services
- Region
- United States
- Timeline
- April to September 2026
- Role
- Architecture, build, deployment and operations
Stack
- Python
- TypeScript
- Claude API
- Microsoft Graph
- Supabase
- n8n
- systemd
- ChatGPT scheduled tasks