Enterprise AI Implementation Workbench

Context

Implementation teams receive requirements in inconsistent formats, then spend time translating them into scope, plans, tasks, customer updates, and operational handoffs. The Workbench makes that translation inspectable: retrieval sources become opaque citations, model output is schema-validated, repair is recorded as evidence, and no delivery mutation happens before a human approval.

What is interesting technically

• Multi-tenant boundaries are repeated in RBAC, application queries, transaction-local RLS, private S3 keys, and isolated demo workspaces.
• Asynchronous work is durable: Postgres is the source of truth, SQS carries only a job pointer, per-claim fencing protects transactional database writes, and a durable attempt ledger makes retries and dead letters inspectable.
• AI quality is an evidence packet, not a single score: retrieval, redaction, schema validity, citation coverage, injection checks, cost, latency, repair, and reviewer outcome are linked.
• Enterprise controls are explicit: OIDC with PKCE, SCIM lifecycle APIs, encrypted secrets, signed webhooks, bounded retention, trace correlation, and a local observability profile.

How to evaluate the demo

1. Open the grounded AI checkpoint and inspect retrieval and repair evidence.
2. Use the role dock to switch to the manager, approve the pending plan, and watch milestones/tasks materialize.
3. Open Operations to show a seeded dead-letter job, retry path, and the separated reliability targets.
4. Switch to the customer persona and confirm the timeline exposes published delivery state without internal rejection or prompt detail.

Scope and ownership

This repository is an end-to-end portfolio implementation: product workflow, multi-tenant data model, AI evidence pipeline, background-job reliability, enterprise control APIs, infrastructure-as-code, tests, and public proof are maintained together so architectural claims remain inspectable.

Constraints and tradeoffs

The default path is intentionally reproducible without paid cloud credentials: LocalStack, PostgreSQL, deterministic mock generation, and synthetic tenants exercise the same boundaries as the AWS shape. Live-provider cost and staging reliability are withheld unless matching telemetry and CI provenance are attached, and generation remains a proposal until a separate reviewer approves it.