The AI proposes. Deterministic code decides. A person publishes.
Language models are useful for understanding how a business works and for drafting changes. They are not trustworthy enough to edit a business system unsupervised — so in Tavuni they never do.
Draft, explain and propose.
- Hold a conversation about how the business works and record what was said
- Propose a business model or a change as operations from a fixed vocabulary
- State the assumptions it made, so a person can disagree
- Cite which facts each part of its proposal rests on
Edit, publish, or grade itself.
- Return a whole application or write code — only operations deterministic code can validate
- Publish anything — the publish action is refused for an assistant and allowed only for a person
- Claim the platform derived something: that label is withheld from the model's vocabulary
- Mark its own work: a citation to a fact that does not exist refuses the whole proposal
What works today, and what does not yet.
AI app generation is crowded with demos. This is where Tavuni actually stands.
| Capability | Status |
|---|---|
| Discovery: understanding a business from a conversation, with every fact traced to the sentence it came from | Works with a live model |
| Per-organisation AI policy, model registration, monthly budget, metering and concurrency limits | Built and tested |
| Provenance: a proposal must cite facts that exist; the platform grades the citations, not the model | Built and tested |
| Turning that understanding into a complete application through a live model | In development |
| Conditional thresholds (“when leave exceeds two weeks”) arriving through the AI path | Not yet |
| Plain-language change proposals in the public demonstration | Deterministic code, no model |
AI is off until someone decides otherwise.
Your provider, your key
An administrator registers a provider and model for their organisation; credentials live in an encrypted vault.
A budget that is enforced
A monthly token budget per organisation and every call metered — and when the platform refuses a model’s answer, that turn is not counted against the customer.
Network-safe by default
Calls go through a hardened transport that refuses internal addresses, checked on every request.
See it work on a real workbook, in your browser.
The example operations workbook opens in Tavuni with no account and nothing uploaded. Every number on this site comes from that same pipeline.