01 · Public reader
Grounding and access boundaries
A cited Calgary parking answer, a protected employee-data query denied, and abstention when the evidence does not support an answer.
View the public reader walkthrough →Matthew Xu · Applied AI project portfolio
Enterprise AI Knowledge & Action Hub
A conversational agent that connects company knowledge and PostgreSQL records, checks access before protected tool execution, and grounds its answers in evidence.
Explore the captured demonstrations first, then try the deployed public reader experience. The walkthroughs show both useful answers and the boundaries that constrain them.
Three ways to explore
02 · Controlled local demonstrations
Roles, tools and human decisions
Reader and HR access comparisons, a salary proposal followed by rejection, knowledge-upload permissions, duplicate detection and execution traces.
View the role-access walkthrough →03 · Engineering
Architecture and decisions
How the API, orchestrator, authorized tools, RAG and database fit together, plus the release process and the scope of the evidence.
Explore the architecture →Try these questions as a reader
The live app requires an assigned demo account. Request credentials from Matthew Xu. Sign in as the reader to try these questions; the screenshot walkthroughs remain available without sign-in.
- “What is the Calgary parking policy?” — look for an answer with its source.
- “Who is the highest-paid employee?” — expect an access denial for this reader.
- “What is the company policy for bringing pet llamas into the Calgary office?” — expect abstention if no sufficient authorized evidence supports it.
Role screenshots were captured locally. Hosted sign-in, reader permissions, HR-reader access, and writer proposal/rejection have also been verified. Credentials are shared privately. Captured answers document individual runs; live results and availability may vary.
Implementation highlights
Python · FastAPI · Streamlit · PostgreSQL/pgvector · retrieval-augmented generation · tool authorization · human-reviewed action proposals · Google Cloud Run · Cloud Build · Secret Manager
The manually initiated release pipeline builds and tests images, runs migrations, deploys the two services and checks Cloud Run readiness and traffic. Browser behavior is verified separately.