A hotel concierge that answers from the rules.
Most AI agent demos run on a laptop. This one is built the way a client project should be: written requirements, a reasoned architecture, tickets, attack-testing, deployment and monitoring. The hotel, Kestrel Cove, is fictional; the engineering is real.
Video walkthrough coming soon
The result first, then exactly how it was built: the docs, the tickets, the attack tests and what they caught.
Useful to guests, safe for the business.
Answers from the rules
Reads the hotel's published policies in full and says which one it used. If the answer isn't written down, it says so instead of guessing.
Finds the right villa
Checks every night of the stay against party size and availability, and asks for dates or guest numbers before it searches.
Never books on its own
The guest confirms reservations and requests with a button. The AI can draft, but it can't commit.
Keeps guests' data apart
Each visitor only ever sees their own conversation and booking. Conversations delete themselves after 30 days.
Kestrel Cove and its villas are invented for this demo; the photography is AI-generated.
Seven steps, written down before the code.
- 01
Requirements
Fifteen numbered requirements, each with the evidence that proves it works: answers only from published policies, no invented prices, guests can only see their own booking, nothing is booked without a button press.
Done - 02
Architecture
Website on Vercel, the agent on Google Cloud Run, a fast low-cost Gemini model, MongoDB with automatic data expiry, secrets kept out of the code. Every choice written down with the reason and the alternative.
Done - 03
Plan
Six milestones and nineteen tickets. Each ticket is a mini-spec (goal, done-when, how it will be checked) so a coding agent can pick it up with nothing else.
Done - 04
Build
Hotel content, website and concierge widget first; then the API, the agent's tools and the live AI answers. Built by directing AI coding agents, ticket by ticket.
In build - 05
Try to break it
An AI drives a real browser and attacks the concierge: asks for other guests' details, its hidden instructions, passwords, script injection, rude and off-topic questions. Every defect gets logged and fixed.
Next - 06
Deploy
Live on the public internet with the same checks as a client project: health endpoint, least-privilege access, rate limits so nobody can run up a bill.
Next - 07
Operate
Daily backups, error and speed alerts, and an evaluation loop: a fixed set of test questions scored before and after every change to the agent's instructions, regressions included.
Next
Built on free tiers. For a paying client the same design moves to managed backups, an enterprise model endpoint and a real booking system, with no rewrite.
- A portfolio build, not a client project. No real bookings or payments.
- Benefits like fewer repeat questions for staff are things to measure with a real hotel, not claims.
- Status above is updated as each milestone ships.
An AI agent your customers can trust.
Same process, your rules: what it may say, what it must never do, and how we prove it before it meets a customer.