Sprintbot — agile management with AI
Giving an AI agent permission to create, edit, and delete real data in a multi‑tenant app is the easy part. The hard one —and the one that matters— is containing what it can do when it's wrong, abused, or runs away on cost.
- Year
- 2025
- Role
- Solo full-stack developer
- Stack
- Next.js · TypeScript · Firebase · Gemini · React Flow · Tailwind
- Status
- View demo
The productA project management platform in the spirit of Jira or Linear: Kanban, table, calendar, Gantt, outliner, and a dependency canvas (Blueprint) built with React Flow, auto-layout, and critical-path calculation. It adds sprints with burndown and velocity, real-time collaboration, a PWA with offline mode, and a custom AI assistant (Sage) built on an orchestration pipeline with @google/genai: intent routing, specialized experts, dozens of flows (briefings, predictive alerts, retrospectives), and short- and long-term memory. Multi-workspace architecture with roles and permissions. A personal project through which I learned to build SaaS end to end.
- from prototype to production
- Jul 2025 → Jun 2026
- tools with RBAC + Zod
- 41
- token ceiling per conversation
- 50K tok
- automated test cases
- ~1.9K
01 · sheet 02 ①
The problem
Sprintbot ships with Sage, an assistant that performs real actions from natural language: it creates tasks, edits projects, deletes notes. That means handing a model that occasionally hallucinates the keys to several organizations' production data at once. Three concrete risks: a model mistake corrupting data, a user crossing from one workspace into another, and a long conversation driving token cost with no ceiling.
02 · sheet 02 ②
The architecture
The answer wasn't an agent framework but a layered pipeline of my own, each layer doing one job of containment. A cheap router —a lite model, plus rules that resolve the common intents without spending an LLM call— classifies intent before the expensive model is touched. A multi-turn agent loop capped at 5 iterations and 50,000 tokens that, once the budget runs out, forces a text-only reply instead of spending more. A registry of 41 tools where every call passes schema validation (Zod), role-based permissions (RBAC), and a resilience wrapper (retries with backoff, circuit breaker, timeout). And an explicit human confirmation before any destructive action.
03 · sheet 02 ③
The trade-off
Building the loop, the resilience layer, and the schema conversion by hand —rather than adopting a framework— is more code of my own to maintain. I chose it deliberately: it gave me full control over the token budget, over the confirmation flow, and a way to fix a real mismatch between the JSON Schema that Zod emits (draft-04) and the one Gemini's API expects (draft 2020-12). The cost is maintenance; the gain is that no piece is a black box when something breaks in production.
04 · sheet 02 ④
The result
Sage is live in production. The most telling part wasn't that it works, but what I found when I audited myself: the agent endpoint authenticated the user but never verified they belonged to the workspace they asked for —and because the tools run with admin privileges that bypass Firestore rules, that opened the door to crossing data between organizations. I closed it, wrote the threat model into the commit itself, and logged the rest of the audit with per-finding traceability: what was fixed, what was deferred as known debt, and its phased migration plan. Documenting the risk that remains instead of pretending it doesn't exist is, to me, the difference between building with AI and building with judgment.
LiveView demo