Boundary 01
Read-only specialists
Property research, leases, accounting, and guest drafting are constrained to review, extraction, summarization, and handoff. They do not broadly execute or write.
Case study · Real estate management company
Real estate operations, routed safely.
A local AI operations layer that turns Slack, WhatsApp, email, documents, images, and operational records into review-ready work without giving agents unchecked authority over legal, financial, tenant-facing, or external systems.
01 / The problem
The work arrived everywhere. The source of truth lived nowhere.
The company managed real estate operations across leases, accounting, tenant questions, property research, task dispatch, and short-stay guest communication. Work showed up as Slack messages, WhatsApp messages, email attachments, PDFs, photos, and local spreadsheets.
The hard part was not making a chatbot reply. The hard part was building an operations layer that could normalize messy intake into structured queues while keeping humans in control of external, legal, financial, and tenant-facing actions.
The build: a local OpenClaw deployment on a client-owned Mac Mini, served through a private network route, with seven named agents, durable JSON stores, OCR and extraction pipelines, deterministic scripts, handoff records, journals, and approval gates.
0
specialist agents in one local system
0
intake paths normalized into queues
0
workflow domains with explicit owners
0+
tenant records available for authorized lookup
02 / Architecture
A local command layer with domain agents, durable state, and review queues.
The system treats Slack and WhatsApp as work surfaces, not as the source of truth. Tap any component to see how it fits.
Intake surfaces
Local runtime
Coordinator
Specialist agents
Durable state + scripts
03 / Operating model
The rules were simple. The implementation made them enforceable.
1
Safe local work moves fast.
Extraction, classification, queueing, summarization, and internal drafts can proceed without waiting on a human for every small step.
2
External and regulated actions are approval-gated.
Broker outreach, lease writes, financial submissions, guest replies, tenant-facing communication, filing, and record changes require explicit approval unless the workflow is narrowly pre-approved.
3
Context must be recoverable.
Agents recover from queues, journals, handoff records, per-agent workspaces, and session conventions rather than relying on the current chat transcript.
04 / Workflows
From messy intake to review-ready work.
Pick a workflow to watch how the system handles real operational input without turning risky steps over to a model.
Illustrative messages with anonymized details. The flows, boundaries, and implementation patterns are the real build.
05 / Safety architecture
Review-first was not a policy note. It was the shape of the system.
Specialists can reason, extract, and prepare work. Only narrow deterministic paths and trusted operators can mutate sensitive systems.
Boundary 02
Write authority is concentrated
Only the main coordinator and private admin agent hold general write or execution authority, and admin configuration is isolated from public operational channels.
Boundary 03
Scripts handle risky mechanics
Task state, Dext-prep approvals, OCR outputs, imports, and journals are handled by deterministic scripts rather than hand-edited agent state.
Boundary 04
Inbound content is untrusted
Email bodies, PDFs, invoice captions, lease text, and Slack uploads are data to extract from. Agents do not follow embedded instructions inside them.
Boundary 05
Channel-specific formatting
Slack uses threads and native mrkdwn. WhatsApp avoids tables and long markdown, with one task per direct message so workers receive clean actions.
Boundary 06
Explicit external-action gates
No broker outreach, tenant communication, guest reply, lease write, accounting submission, Drive filing, or record change happens silently.
06 / What this build demonstrates
Not a chatbot. A local operations layer.
The durable value was in routing, persistence, extraction, handoffs, and explicit control over sensitive work.
Named specialists beat one general bot
Each domain has an owner, a workspace, and a boundary. The result is easier to reason about, recover, and govern.
Chat apps are surfaces, not databases
Messages trigger intake, but durable JSON queues, journals, handoffs, and extracted records become the working memory.
Automation belongs around risky actions
The riskiest operations are wrapped in deterministic scripts and approval states instead of relying on free-form agent behavior.
Document extraction needs review paths
OCR, Textract, and classifiers are valuable because missing fields and ambiguity are surfaced for people to resolve.
Local deployment can be the right architecture
A client-owned machine, private access path, local stores, and gateway restrictions gave the company control without blocking automation.
Recovery is a product feature
Agents were expected to reconstruct context from durable stores before claiming they lacked it. That is what turns sessions into operations.
✦
The business is intentionally unnamed. People names, inboxes, channel IDs, exact paths, hostnames, ports, and private operational identifiers are excluded from this write-up.
Start here
Need an operations layer that keeps humans in control?
If work is scattered across chat, email, documents, spreadsheets, and fragile systems, this is the kind of operating layer we build: practical automation, grounded review, and clear approval gates.