Praxis AI: an assistant that works inside your system, not beside it

Summary

In the client systems we build, Praxis AI reads data, drafts documents and starts routine tasks, but only within the permissions of the person asking. Account, card, tax and phone numbers are removed before any text leaves, and it keeps no copy of your database.

The problem

Many AI features added to business software fail one of the tests below. Organisations tend to find out after the fact.

Where does the data go? A member of staff asks the assistant to summarise a customer’s history. The tool collects the full record, recent invoices, payment disputes and the account number, and sends them to a model provider in another country. Nobody in the organisation knows it happened, and there is no record of it. The provider’s terms may allow it to keep that text for a period.

Who is the assistant acting as? A warehouse clerk who may only scan deliveries asks the assistant to draft a supplier invoice and mark it for payment. The assistant does it. The audit trail records the entry faithfully, but it records an action the clerk had no right to take.

What leaves the building? Even with a signed contract, a tool that sends account numbers, card numbers, tax numbers and phone numbers with every question relies on a promise, not a control.

Praxis AI is designed to pass all of these tests.

What was done

Praxis AI follows one rule: the assistant never has more rights than the person asking, and identifiers are removed before any text leaves. In practice, it works as follows.

1. Permissions are checked for the assistant too. Every action the assistant can take, from reading a customer record to drafting a quotation, is listed with the permission it needs. Before it acts, the assistant checks the person’s permissions in the same way the screens do. If the permission is missing, the action is refused and logged. If an action has no permission listed at all, it is refused as well, so a forgotten setting produces a visible refusal rather than a hidden gap.

2. Each organisation’s data is kept apart by the database itself. Every read runs through a database connection limited to the organisation of the person asking. Another organisation’s data cannot be returned, because that connection cannot see it. PostgreSQL enforces this, not a check that someone has to remember.

3. Confidential documents stay confidential. Documents in the knowledge base carry a confidentiality level, and a search returns only what the person asking is allowed to see. A confidential HR memo never reaches the assistant for someone without HR permissions, because the query never returns it.

4. Identifiers are removed before text leaves. Before any text goes to the language model, a filter replaces IBANs, card numbers, the RIB bank account numbers used in the OHADA zone, tax numbers such as the NIU, phone numbers, email addresses and long runs of digits with neutral labels. It applies to the question, the conversation so far, the documents retrieved and the result of every action. The model sees a label, not the customer’s account number.

5. The assistant has tools, not a copy of your data. It works through a list of named actions, each with its own permission. To answer a question, it runs one action as the person asking, returns the answer and keeps no copy of the data. There is no copy of your books in someone else’s cloud.

6. Everything is logged. Questions sent to the model, actions taken, refusals and results are all recorded. If an auditor asks what the assistant did for a given person on a given day, there is an answer.

7. The model can run where you need it. For banks, public bodies and health organisations that cannot send text abroad, the same design can use a model hosted on their own servers or by a local provider. The code stays the same; only the address of the model changes.

The Praxis AI assistant on jbspraxis.com is different: it answers only from our public pages and sees no client data, and our privacy policy explains where its questions go.

The result

Teams can trust the assistant with real work, such as drafting quotations, opening files and chasing payments, because it can never do more than the person asking and everything it does is logged.