Week 6 of 8 · Build AI

Architecture, integrations and security

Design the codebase before connecting it: the principles, then integrations into the systems a business runs on, the config-first monorepo that holds them, and the security that protects them.

What the week builds toward

WorkBot redesigned on the architecture principles and moved into a config-first monorepo; connected to a CRM, a ticketing system, a calendar and GitHub over a unified, rule-applied data layer; configuration per customer with a rule language and a generator; roles, row-level security, personal-data handling and managed secrets.

The 5 days

  1. Day 26

    Architecture principles: what to unlearn

    5 architectures to drop and the config-first, lightweight design to adopt, applied to WorkBot.

    You ship: An architecture audit, 2 migrations measured before and after, and a decision record.

  2. Day 27

    Integration platforms: Composio, Nango and MCP

    Managed auth, syncs and MCP as 3 routes into a customer's SaaS, and the tool surface on top.

    You ship: The agent connected to a CRM, a ticketing system and GitHub through 3 routes, wrapped in product-level tools.

  3. Day 28

    Integration techniques: sync, unified schemas, rules and caching

    Incremental sync, one schema across providers, deterministic rules, and per-field caching.

    You ship: A unified, rule-applied, cached data layer under the integrations, with reconciliation and an audit trail.

  4. Day 29

    Config-first design, grammars and meta-compilers

    Behavior as configuration, a BNF grammar and parser for a rule language, a generator, and the monorepo that holds them.

    You ship: WorkBot in one config-first monorepo, with a second tenant from configuration, a rule language with 20 tests, and an entity generator.

  5. Day 30

    Agent security: RBAC, keys and data separation

    Authorization enforced below the model, tenant separation in every store, key and secret handling, and injection defenses tested against an eval set.

    You ship: WorkBot integrated, config-first and hardened, with an injection eval set it fails.