AI Executive Office — CXO Assistant Platform  ·  View 15 of 30  ·  5 · Runtime

Critical Flow — One Question, End to End

The path a single executive question takes, and the two places it can honestly fail.

Editable source SVG draw.io All views
CXO Experience API Orchestrator Tool plane Metric service Retrieval Azure OpenAI Guardrail 1. "What is our cash position, and what puts it at risk?" 2. validate token · resolve tenant 3. turn + on-behalf-of assertion 4. classify and plan 5. plan: 1 metric, 1 search 6. get_cash_position(as_of) 7. check scope · freshness 8. DAX measure, RLS as caller 9. value · as-of · lineage 10. typed result + evidence id 11. search_risk_notes(topic) 12. hybrid query, security filter 13. 6 passages the caller may read 14. passages + evidence ids 15. compose from evidence only 16. draft + claim-to-evidence map 17. verify every claim 18. one claim unsupported 19. drop claim · record the gap 20. answer · citations · freshness 21. answer, every number traceable Critical Flow — One Executive Question, End to End Target: p95 under 5 s for this shape. The model is called twice and touches no data source; the tool plane carries the caller's identity into every read. v 1.0 · owner Data & AI Global Practice · date 2026-09

What this proves

  • Twenty-one messages, two model calls, and no message in which the model reaches a data source. Every read is a typed tool invocation carrying the caller's on-behalf-of assertion
  • The guardrail step is a real branch, not a formality: a claim that cannot be bound to evidence is dropped and the gap is recorded. The answer gets shorter rather than less true
  • The metric is fetched from the semantic model with row-level security evaluated as the caller. There is no path in which the platform computes a KPI itself

Numbers

  • p95 target 5 seconds for this shape; the model calls are the dominant term, which is why intent classification uses a small model
  • A semantic cache keyed on question plus tenant plus the caller's permission fingerprint. The fingerprint is what makes the cache safe rather than a leak with a hit rate
  • Anything requiring more than four tool calls is promoted to an asynchronous investigation

Deliberate omissions

  • Retries, circuit breakers and the cache lookup are omitted for legibility. The failure behaviour is in view 25
  • The identity exchange is compressed into one arrow here; view 27 is the full chain
◀  Enterprise Knowledge — Ingest to Cited Answer All views Agent Orchestration  ▶
Solution Architecture v1.0 · Azure-native, multi-tenant, sovereign-capable · Data & AI Global Practice · 2026-0915-question-to-answer-sequence