Nexxt Nest GroupSIYA
Call us · (03) 4517 8310

Engineering

How we build

Six short notes on how the systems in Selected Work are actually engineered, written to be readable by anyone and checkable by an engineer. The diagrams describe real production systems, at the level of detail that is safe to publish.

Agent authority and human approval

Agents are useful exactly up to the point where they act without accountability. Every agent intent in SIYA is classified into an authority level: research runs freely, drafting runs freely with output held, and anything that would contact a person, spend money, sign, delete or deploy is intercepted and queued for a human decision. The decision (approve, edit or reject) is written to an approvals ledger. The practical effect: the system can be ambitious about discovering work precisely because it is conservative about executing it.

governed agentspropose intentsAuthority checkclassifies L0–L4L0 · Read & researchruns freelyL1 · Draft contentruns freely, output heldL2 · Contact / sendqueued for approvalL3 · Spend / contractqueued for approvalL4 · Delete / deployqueued for approvalHumanapprovalapprove · edit · rejectEvery decision is written to an approvals ledger and audit log.

Voice-agent architecture

A phone call is the least forgiving interface: latency is audible, errors are social, and the transport is a raw WebSocket. SIYA's telephony layer is an RFC 6455 WebSocket server implemented on Python's standard library, speaking Twilio ConversationRelay, with HMAC request-signature validation. A single-use, 60-second relay token is also minted in the TwiML response and required at the WebSocket handshake, because ConversationRelay has no native WebSocket signature scheme. Real-time barge-in means a caller can interrupt mid-sentence and the agent stops talking.

Callerreal phone lineTwilioHMAC-signed webhookTwiML responsemints single-use tokenWebSockettoken checked at handshakeLLM + speechbarge-in interrupts mid-replyConversationRelay's WebSocket has no native signature scheme. A single-use,60-second relay token closes that gap. Implemented on the Python standard library, no frameworks.

Multi-tenant security: RLS and database-enforced roles

In a multi-tenant SaaS the client application should hold no authority. Across OHS Builder Victoria and Nexxt Site Manager, tenancy and roles are enforced in PostgreSQL itself: row-level security scopes every query to the caller's organisation, and role checks live in the database rather than the JavaScript. Both products use reviewed, versioned migrations, including dedicated hardening passes for tenancy, RBAC and audit separation.

Client appholds no authorityAuthenticated requestuser + org identityPostgreSQL (Supabase)Row-level security · every query scoped to the tenantRole checks enforced in the database, not the clientNo compliance status without a verifiable artifact behind itPattern used across OHS Builder Victoria and Nexxt Site Manager.

Audit trails and evidence-based status

A green tick is a claim; the question is what stands behind it. OHS Builder Victoria refuses to display a compliance status unless a database-verifiable artifact exists for it. Submitted and verified are different states, and nothing defaults to 100%. SIYA applies the same principle to agents: findings carry sources, actions land in an audit log, and approval decisions are recorded. Systems that can prove what they say age well; systems that can't, don't.

Production deployment, without a platform team

Three systems, three deployment shapes, one person operating them. Vercel serverless with production cron jobs and webhook endpoints for Nexxt Site Manager; Cloudflare Pages and functions for OHS Builder Victoria; and for SIYA a systemd service on a Linux server behind a Cloudflare Tunnel that exposes only a whitelisted route surface, with watchdog, dated database snapshots and a documented backup/rollback procedure. Boring, inspectable operations are a feature.

Directing AI Under Engineering Authority

Nexxt Nest Group directs AI tooling under engineering review: research workflows, coding agents, MCP/tool integration, automated test suites and human-reviewed deployment, with the model or tool selected for the task at hand. AI-assisted engineering is not a shortcut; it is a discipline of direction, review, testing and governance, and the 460+ test files across SIYA and Nexxt Site Manager, with their audit trails, are what that discipline looks like in practice.

See the systems