An assistant inside a product you already ship
An assistant embedded in a product you already ship. It is scoped to the signed-in user's own data and permissions.
“Our users keep asking support the same questions. They could answer them alone if the product told them.”
What does the system look like?#
How does a request move through it?#
- Ask inside the product
A user asks a question or requests an action from wherever they are in the product. The product needs no separate chat window.
- Assemble in-product context
The current record, the page, and the user's permission set enter the prompt automatically. The user never explains who they are or what they are viewing.
- Call through a model gateway
The request goes through a model-agnostic call layer. Application code does not call a provider SDK directly. A provider change is a config edit.
- Route through scoped tools only
Tools reach only the product's own APIs. Each tool is scoped to what an in-product assistant needs. The router exposes no broader internal surface.
- Treat retrieved and product content as untrusted
The assistant reads tickets, notes, and fields that users filled in. The system validates this content before it can drive a tool call. An anonymous request gets the same check.
- Scope every action to the signed-in user
A tool call inherits the permissions the signed-in user already has. It does not use the assistant's broader service account.
- Trace and eval every turn
Every question and action is traced. The team samples traces into an eval and an injection red-team review. Any production AI feature needs the same discipline.
What are the pieces, and what breaks without each one?#
Context assembler
Pull the current record, the page state, and the user's permission set into the prompt automatically.
Breaks without it: The assistant answers in general terms. It does not address the specific thing the user is viewing.
Model gateway
Route every call through a model-agnostic layer. Do not call a provider SDK directly from application code.
Breaks without it: A provider price change or outage forces a rewrite at every call site. With a gateway, it is a config change in one place.
Scoped tool router
Expose only the product APIs that the assistant needs. Keep every broader internal surface hidden.
Breaks without it: A successful injection or a wrong model decision can reach far more of the product than the assistant's job requires.
Injection guard
Treat all product content as untrusted input. This includes tickets, notes, and uploaded files. Handle it like an anonymous request.
Breaks without it: A note or ticket written to read like an instruction runs with the assistant's real tool access.
Permission scoping
Run every tool call under the signed-in user's permissions. Never use a broader service account.
Breaks without it: An assistant session can read or act on data that the user cannot see in the product's UI.
Trace & eval loop
Log every turn and sample a slice into a golden set and an injection red-team review.
Breaks without it: A quality or safety regression ships. A user finds it before the team does.
Which choices need a decision?#
| Decision | Default choice | Why |
|---|---|---|
| Model gateway | Build a thin abstraction layer in front of the provider you start with. Size it to your call sites | You do not need a full routing product on day one. Hardcoding one provider's SDK into product code turns the next price change into a rewrite. |
| Tool access | Wrap the product's existing internal APIs. Do not build new endpoints just for the assistant | A parallel API surface built only for the assistant tends to drift from the product's permission model. |
| UI surface | Embed the assistant in existing product chrome, contextual to the page a user is already on | A separate chat panel does not know what the user is viewing. It pushes the context-gathering work back onto the user. That defeats the purpose. |
| Observability | Add a dedicated LLM trace store. Do not stretch an existing APM tool to cover prompts and tool calls | General-purpose APM was not built to store or query full prompt and completion text. Bolting that on gives a worse version of a purpose-built trace store. |
What drives the bill?#
- Token volume that grows with product usage and is not a fixed feature cost
- Context-assembly calls into the product's own APIs on every turn
- Tool calls into product backends per action the assistant takes
Dominant cost Token volume that scales with active seats. It is not a flat per-feature number. Cost per active user matters more than a single aggregate estimate.
The lever A model cascade for simple in-product questions. Stable-prefix caching covers the system instructions and tool definitions, which rarely change.
Model your own numbers with the AI Cost Calculator →How do you know it works?#
Tool-call argument validation rate
Confirms that every tool call the assistant makes traces to a real value and not an invented one.
Injection red-team set against product content
Plants adversarial instructions inside notes, tickets, and uploaded content. The direct chat prompt is not the only entry point.
Task completion rate on live traffic
Tracks whether the assistant resolves what users ask. A fluent answer is not enough.
Drift detection against a live-traffic sample
Catches a provider-side model update that changes behavior between releases.
What will your reviewers ask about this?#
Attack-surface mapping for every content ingestion point
The team names every place where untrusted product content reaches the model. It also lists what is reachable downstream.
Secrets held out-of-band from the model context
The orchestration layer injects credentials for tool calls directly. Credentials never enter the prompt that the model reads.
Field-level minimization on assembled context
Only the fields the current turn needs enter the prompt. The full record does not enter by default.
Which patterns and failure modes tie in?#
How long does a first version take?#
6-10 weeks to a first scoped assistant inside one part of the product. Most of that time goes to tool scoping and the injection threat model. The model call takes little.
When is this the wrong shape?#
- The product has no clean, scoped API for the assistant to call yet. Automating a UI that has no machine access is its own project. Do that first.
- You want the assistant to act with the same broad permissions for every user. This architecture exists to limit that blast radius. It does not support the shortcut.
- The task is rare. A good search bar or a help article already solves it for most users.
Sources
- OWASP - OWASP Top 10 for Large Language Model Applications
The ranked risk list our security review checks are organised against. Retrieved 2026-08-24.
- MITRE - MITRE ATLAS
The catalogue of adversary tactics against AI systems our findings are labelled with. Retrieved 2026-08-24.
A Ship Audit checks which of these an existing or planned system needs. It ranks them by what is most likely to break first.