The client wanted a conversational assistant that behaves like a senior data analyst: an executive asks in plain language and gets a genuinely useful answer, not a dashboard. It also had to survive a strict security review. Those two goals pull in opposite directions, and reconciling them is the whole story.

Context

The audience is senior and the data is real. A single invented figure in front of a board ends the engagement, and a single row shown to someone not entitled to see it ends it faster. The brief was explicit: wow a non-technical executive and pass the security review with the same system.

The constraint

Language models are fluent with numbers and unreliable at producing them. Catching a fabricated figure after the fact, with a reviewer or a second model, is a bet that the reviewer is never wrong. For this audience that bet is not good enough. The system had to make a wrong number impossible to write, not merely unlikely.

The one decision that mattered

The model never calculates. Two protected layers enforce it.

• A governed data spine. The only thing the model can reach is a registry of typed capabilities, executed under PostgreSQL's native row-level security and column masking through a read-only role that cannot bypass either. There is no raw-SQL tool. The model emits a plan over typed operations; it never touches a table.
• A control plane and the evidence-ID law. Every fact carries a receipt minted only by the deterministic engine: a content-hashed, tamper-evident record of what was computed, over what, and when. A claim without a valid, matching receipt is blocked mechanically before the user sees it, and the figures in the answer are rendered from the receipt itself. A wrong number is un-writable.

What an answer looks like

Decisions worth reading

Ninety-four architecture decisions are recorded in the repository. The ones that carry the most weight:

• Typed capability registry as the security boundary. The model-facing surface is a catalog of typed operations with a per-user permissioned manifest; a capability the user is not entitled to does not exist for that turn.
• Evidence records hold references and hashes, never raw rows. Receipts persist in an append-only ledger, so a figure in an old conversation can be re-verified and re-entitled on open.
• Constrained decoding for the model-to-control-plane contract. The model fills a grammar; it cannot invent a field, a number, or a capability name.
• The evidence-ID law extended to prose. A claim-strength grammar and a deterministic causal-honesty guard stop the narrative from asserting more than the receipts support.
• Composite figures need composite receipts. A total across currencies is un-writable unless the engine minted it; a token-level "digit net" catches any number the model tries to smuggle into the text.
• Prompt-injection containment. Data content is data, never instructions, by construction rather than by prompt.
• Honest read surfaces for the long tail. A labelled gateway for model-drafted SQL, a Discovery mode for uncertified external databases, and a verified-metrics path where an AI-drafted query is human-certified and then engine-run. Each is stamped for what it is; none can mint a governed receipt.
• The evaluation judge is advisory, never a control. Scores come from the real governed path, not a recompute, and no LLM grader gates production.

Arabic-native by design

The engine works in the Hijri calendar as well as the Gregorian one and speaks the business vocabulary of the region. It also handles a failure most systems never notice: when a business term has two legitimate readings, the analyst answers the likely one and offers the alternative with its own number, instead of quietly picking one and being confidently wrong.

Proving it works: Data Invoker

A demo needs data with real patterns in it, and a claim like "the analyst finds the true signal" needs an answer key. So I built Data Invoker, a synthetic-data engine that generates a coherent person first, derives a behaviour contract from who that person is, then deterministically simulates their orders, reviews and complaints from that contract. Because the persona causes every row, the tool knows the truth: it ships a ground-truth answer key with the planted segments, cadences and churn points, plus deliberate decoys.

• The language model appears in exactly two places, menu design and persona writing. Everything downstream is plain, seedable Python, so runs are reproducible from frozen artifacts and cost scales with customers, not rows.
• A scoring contract grades an analyst's typed findings deterministically against the key. It rewards a correct descriptive claim over a wrong causal one, and it penalises overclaiming causality. No LLM judge over prose.

That turned demo data into a benchmark: whether the analyst found the real insight, resisted the tempting false one, and did not overclaim cause.

How it was built

One person, held to team discipline. Every change went through a pull request that was reviewed and CI-gated before merge: 387 of them. The test suite runs against a real PostgreSQL, not mocks, and the UI has its own browser suite. Every material decision is an ADR. The engineering process itself, where a human owns direction, two independent models argue the judgment calls, and tests and CI own correctness, is open source as agentic-methodology.

Result

A working analyst that executives can trust with real numbers, delivered solo and demonstrated live, with the guarantee enforced by architecture rather than by review. The counts above are taken from the repository as of August 2026.

What it demonstrates

How to make a language-model product safe for an audience that will check: move the guarantee out of the prompt and into the system, keep the model where it is good (planning, explaining) and out of where it is not (arithmetic, entitlement), and build the evaluation data that proves it.