Architecture defense · interview mode

From “wow demo” to enterprise-grade reasoning

Identity, model routing, RAG, controlled agents, governance, data boundaries, failure modes and the trade-offs behind BeautyAI.

Executive home AI Native Lab Workflow OS

Reference architecture

9 layers, one accountability chain

1. ExperienceNext.js App Router

Executive, AI-native, workflow and value surfaces.

↓ explicit contract / policy boundary

2. Identity & policyEntra / RBAC planned

Resolve role, workspace and market before data or model access.

↓ explicit contract / policy boundary

3. Application / BFFRoute handlers

Validate input, enforce policy and keep provider credentials server-side.

↓ explicit contract / policy boundary

4. AI gatewayProvider abstraction

Route models by capability, region, risk, availability and cost.

↓ explicit contract / policy boundary

5. KnowledgeRAG-first

Retrieve approved evidence with provenance; fine-tune only stable behavior.

↓ explicit contract / policy boundary

6. OrchestrationControlled agents

Observable specialist stages; human release for consequential actions.

↓ explicit contract / policy boundary

7. GovernancePolicy + evidence

Privacy, IP, safety, security and oversight are stage-gate requirements.

↓ explicit contract / policy boundary

8. Data & valueRepository boundaries

Demo adapters today; durable governed persistence in production.

↓ explicit contract / policy boundary

9. ObservabilityTelemetry + evals

Model/prompt versions, latency, cost, evidence, gates and audit events.

Failure contracts

Assume the model, network and data can fail

Provider outageCircuit breaker → deterministic fallbackDemo remains usable

Unsupported claimGrounding + structured validation + claim gateBlock release

Prompt injectionUntrusted-content isolation + tool allowlistBlock exfiltration

Sensitive dataPurpose limit + minimization + workspace policyReject/protect

Cost spikeBudget + model tiers + token telemetryThrottle/degrade

RegressionEval + canary + version rollbackStop promotion

Residency restrictionPolicy-based model/storage routingStay in allowed region

Trust boundaries

What is allowed to cross?

Browser → app

Business input and workspace intent; never provider secrets.

validate + authorize

App → model

Minimum necessary context after policy filtering.

minimize

Knowledge → generation

Approved excerpts with source/version provenance.

ground

AI → action

Structured recommendation + evidence before release.

gate + audit

Interview Q&A

Likely architecture questions

Azure OpenAI or direct OpenAI?

Hide both behind an enterprise gateway. Choose the route by identity/networking, regional policy, capability and workload economics rather than coupling the UI to a provider.

How would this scale to 10k–70k employees?

Stateless services, workspace-scoped authorization, queue-backed long jobs, filtered retrieval indexes, model routing, caching, budgets and telemetry by market/function.

How do you reduce hallucinations?

Ground high-risk answers, preserve evidence IDs, validate structured output, run task evals and fail closed when required evidence is missing.

How do you control cost?

Use deterministic logic or smaller models for simple work, cap context, cache stable knowledge and measure cost per business outcome.

How do you handle residency?

Resolve user/workspace/market first, then select approved storage, retrieval and model endpoints. Cross-region processing must be explicit and auditable.

What happens when AI is wrong?

Every workflow has validation, evidence thresholds, human gates, observable versioning and rollback. The architecture assumes model failure.