Most of the platform is decided before the model is called
A request arrives. Something has to establish who is asking, decide which records that person may read, assemble the method the assistant should follow, choose which tools are available for this particular call, and decide where the result is written. The model runs somewhere in the middle of that, and it is the part teams spend the most time discussing.
This playbook works through the rest. It follows one modest job, a maintenance review on a piece of equipment, from the first request to a running stack with a queue, a model gateway and a workspace that survives a restart. The job stays small on purpose, because a small job makes the surrounding decisions legible.
What is inside
Chapters 1 to 12 · The decisions
What to own and what to rent. Giving an assistant one useful job. Following a request end to end. Writing the method once and loading it when needed. Checking access before the model sees the data. Loop limits. Keeping documents from authorizing actions. Putting model choices behind a gateway. Testing a private model on the actual work. Making failures understandable.
Chapters 13 to 22 · The build
Starting the platform and gateway. Adding an assistant from a declarative package. Giving it a method and a workspace. Resuming a conversation safely. Moving long tasks onto a queue and adding a worker without touching the API. Serving a real model on a GPU. Changing the model without changing the product. Following a run with Langfuse. Proving the path before expanding.
Appendices
The runnable package contract, a small executable policy exercise with its own tests, and the questions worth answering before committing to a platform at all.
Permission is the part that keeps being wrong
A person allowed to read one site should not receive another site's record, even when they ask clearly and the model knows the identifier. That check belongs on the server, before the model's working environment is assembled, and again when a tool runs, because permissions can change while a conversation is open.
A service credential is not a person's permission. A connector often holds broader access than the person using it, and filtering the screen afterwards is too late once the content has reached a model or a trace store. The playbook treats that as an architecture question with a test attached, rather than an instruction to put in a prompt.
The companion kit
The reference stack runs locally: a browser and API, declarative agent packages, bounded middleware, permissioned files, conversations that persist, a Redis queue with workers, a LiteLLM gateway, vLLM instructions for your own hardware, and optional self-hosted Langfuse. Twenty-two implementation tests and fourteen standalone policy tests pass from a fresh extraction.
The original companion code is Apache License 2.0, with licence and attribution files included. The publication text and artwork are CC BY-NC-ND 4.0. Third-party components keep their own terms.
The kit comes with the playbook: enter your email above and the download gives you both.
What this does not claim
The supplied application is a teaching lab, not a production service. A shared service needs a real identity provider, reviewed permissions, TLS and managed secrets, dependency and model revision records, backup and restore, tested failure handling, monitoring and measured capacity. None of that is established by the synthetic tests here.
No complete container deployment, live PostgreSQL or LiteLLM path, GPU inference run or live observability export was executed for this edition. No field benchmark or production security certification is claimed, and the PDF is not tagged for accessibility. Those limits are printed in the validation record rather than left for a reader to discover.
Who it is for
Engineers and technical leaders deciding how much of an agentic platform to own, and what owning it actually costs in checks, tests and operational work. If you are weighing a vendor against building, the chapters on gateways, private models and expansion are the ones that will argue with you most usefully.
Free. The reference application is a teaching lab and the equipment example is invented. If you find something wrong in here, write to [email protected] and the correction goes in the next edition.
