Loading…
← HandbookLive
AdminOS
A WhatsApp-native, multi-tenant business OS for South African SMEs — the interface is the customer’s existing WhatsApp line, not a dashboard.
View the product pageThe problem
SA has ~3.7M small businesses running on "a WhatsApp group, a cashbook, and a prayer." Existing tools fail them on USD pricing, no local-language support, heavy bundles that die on prepaid data, and onboarding that assumes IT staff.
Architecture
How it’s wired
The 9-step pipeline classifies intent/sentiment/language, checks the Redis FAQ cache (zero-token on hit), and only calls Claude on a miss. Vercel Cron fans out to six Inngest agent functions for scheduled work.
~72%
AI cost cut (3-layer)
9
step workflow pipeline
6
specialist AI agents
21
tables · all RLS
Stack
Next.js 16 (App Router)React 19TypeScriptAnthropic ClaudeSupabase (Postgres + RLS)Upstash RedisInngestResendMeta WhatsApp Cloud APIPayFastnext-pwaTailwind v4
AI
Six named Claude agents — Alex (inbox), Care (wellness), Pen (email) on Sonnet 4.6; Chase (debt), Doc (documents), Insight (briefs) on Haiku 4.5. Opus 4.8 is reserved for Enterprise strategy.
Data model
21 tables · 100% RLS · 31 migrations
- Tenant isolation: RLS compares JWT tenant_id to row tenant_id on every table
- conversations as a first-class entity (intent/sentiment/status at thread level)
- audit_log with UPDATE/DELETE revoked at the DB level — append-only, even for the service role
Key decisions
Why it’s built this way
ADR-01
Multi-tenancy via Postgres RLS at the engine level
- Context
- Shared-table company_id filtering is one missed .eq() from catastrophe; POPIA fines reach R10M.
- Decision
- RLS comparing JWT tenant_id to row tenant_id; middleware injects tenant/user/role headers.
- Consequence
- Isolation enforced independent of developer discipline.
ADR-02
Three-layer AI cost architecture
- Context
- Naive all-Sonnet was ~R0.12/msg — 35% of Starter revenue.
- Decision
- Model routing (Sonnet ↔ Haiku) + Anthropic prompt caching + a Redis FAQ cache (7-day TTL, zero-token on hit).
- Consequence
- ~72% combined input-cost reduction vs naive.
ADR-03
Meta WhatsApp Cloud API direct, not a BSP
- Context
- Twilio adds p99 4–8s latency in SA and USD billing.
- Decision
- First-party Meta Cloud API, HMAC-SHA256 (x-hub-signature-256) with timing-safe compare, non-blocking 200-within-5s + Redis dedup.
- Consequence
- No BSP cost or dependency; tenants complete WABA verification.
ADR-04
PayFast, ZAR-only, MD5-signed ITN
- Context
- Stripe = USD friction + SA international-card blocks.
- Decision
- Signed auto-submit form → ITN verifies source IP + MD5 hash → set tenant plan.
- Consequence
- Near-zero SA friction; EFT supported, no card required.
The hard parts, solved
Prompt injection on a public channel
A public WhatsApp number is an open pipe to the LLM. Inbound is sanitized at ingestion (16–17 regex patterns + 2000-char cap) before any DB store, so no payload is persisted or replayable; admin config gets a separate sanitizer to prevent cross-tenant cache poisoning.
Meta’s 5-second SLA
Must return 200 within 5–10s or Meta retries and double-processes — solved with a fire-and-forget 9-step pipeline plus a Redis dedup window.
AI unit economics
The three-layer cost stack turns a margin-killing per-message cost into a sustainable one across plan tiers.
Sourced from AdminOS — ARCHITECTURE, SYSTEM_DESIGN, SECURITY_AUDIT_REPORT, WONDERLAND_DECISIONS.
.jpg&w=3840&q=75)