Internal agent instructionsPrivate · client data
This agent answers the client's own operational questions from approved datasets. It can cite reports, state data cutoffs, and must never expose raw customer tables.
How the agent introduces itself and where it is used.
Internal note only. This is not sent to the model.
Approved query templates only. The model selects a dataset and parameters; it never writes SQL or sees raw customer rows.
Revenue by team
Billing replica · revenue_by_team_range
Delayed orders
Orders replica · delayed_orders
MRR movement
Billing replica · mrr_movement
Fleet utilization
AIO fleet API · fleet_utilization
Require identity for customer-level rows
Aggregates stay available; row-level customer data needs a verified assertion.
The client-data scope, metric rules, and hard limits. Published as an immutable version.
What happens when the agent cannot ground an answer.
Private escalation only. Failed delivery pauses instead of falling back to a public channel.
Require citations and data cutoff
Abstain when no approved source supports the answer.
Enforced outside the model. Instructions cannot grant access that policy denies.
SELECT-only, single statement per template
Row limit 5,000 · 30s statement timeout
Metric definitions locked (gross vs net)
Always state the data cutoff
Refuse unapproved datasets and raw tables
Private reply destinations only
Shown in the internal chat composer for authorized members. These are not exposed to customers.
Draft changes are stored separately from the published version.
Public sessions can never call these datasets, even if the bot is added to a public channel.
DeepSeek Flash
$0.15 / $0.60 per 1M tokens
Lower values keep support answers consistent.
State the job, the limits, and the handoff. Avoid stacking rules that contradict each other — models follow the closest instruction unreliably.
- Name the business and the internal audience.
- Say what to do when a query cannot run.
- Put dataset and row permissions in policy, not the prompt.
- Require timeframe interpretation and data cutoff in every answer.
Prompt isn't a security boundary
Tool permissions, tenant filters, and public/internal visibility are enforced outside the model. Changing this text cannot grant access.