BINA is a supply-intelligence agent for agencies. It reads the SSP platforms every night, turns that firehose of data into trustworthy answers, and lets your team act on deals — always behind a human approval chain. This page explains the architecture, the AI, the security, the database, and how new features ship safely to production.
Data flows up from the platforms into insight; actions flow down through a safety gate. The AI never touches raw data or acts on its own.
Everything lives in one chat-first app. Ask a question, read what changed overnight, or work a client's deal book — the same engine powers all three.
One prompt box, two modes. Question answers analytics and benchmarks with a chart, a table, and its provenance. Action drafts a guardrailed deal proposal — it never executes on its own.
“What changed while you slept.” Statement-first cards — the claim, the number, the n — precomputed overnight, so they render instantly with zero model cost at view time.
A per-client deal library synced from the platforms. Status pills, filters, CSV export, and an instant-look expander — everything through yesterday, nothing live, so numbers never flicker.
A strong agent is more than a model. BINA is built on the four layers every capable AI agent needs — each doing one job well.
How one request flows through the brain — the four layers at work
A cheap, fast model (Haiku) reads every prompt and decides intent. A stronger model (Sonnet) composes the answer or drafts the deal. Spend is capped per client.
Every prompt, answer, and action is logged — a product asset that feeds the daily suggestions. Precomputed nightly intelligence and an answer cache keep it fast and cheap.
Today the agent answers in a single pass — the fastest, cheapest path. Multi-step investigation (“why did this deal change, and what should we do?”) is the next build.
The SSP connectors, the approval chain, the database firewall, and the scheduled jobs. This is what lets the agent actually read platforms and (safely) act on deals.
The golden rule: the AI never computes a number and never acts on its own. It reads figures that were calculated deterministically, and it can only propose actions — humans approve them.
Every layer assumes the one above it could fail. A client can never see another client's data, and the AI can never move money on its own.
Each client is a separate tenant. Isolation is enforced by PostgreSQL Row-Level Security — not just app code. Even if application logic had a bug, the database itself refuses to return another tenant's rows. Proven by an automated cross-tenant test.
No write tool is ever exposed to the model. It drafts a proposal; deterministic code evaluates the rules; the action only runs after human sign-off. The agent can never mark its own action as approved.
Operator sign-off is always required. Any change to a LIVE deal is two-party ping-and-approve — explicit client AND operator consent — a rule no envelope can override. Every executed action has a 10-minute undo window and an append-only audit trail.
Platform credentials live encrypted in Supabase Vault, decrypted only inside job code at the moment of use — never in logs, never in prompts, never in the browser.
The model outputs structured data, never raw HTML — closing an entire class of injection risk. Every value is validated before it renders.
One PostgreSQL database, hard-partitioned by tenant. Internal MCG users see every client; each external client sees only their own world.
Every query is checked against the caller's identity — in the database itself
Internal MCG users see every client. Each external client is locked to their own tenant — a query for another client's rows returns nothing, enforced by the database itself.
Cost matters to MCG. Five compounding levers mean most answers barely touch the AI — and every client has a hard monthly ceiling.
Aggregates, benchmarks and bites are built once overnight — chat reads small tables, not the raw firehose.
A repeat question returns from cache, refreshing only the numbers — no model call at all.
The stable system prompt is cached, so instructions cost a fraction after the first request.
A cheap, fast model (Haiku) routes and classifies; the stronger model (Sonnet) only composes — never the other way around.
Every client has a hard monthly ceiling: alert at 80%, graceful degrade to aggregates and Deals at 100%. No surprise bills.
You can use your own Claude Code subscription to build features between our releases. Nothing you change reaches production until it passes the automated gate and our QA.
Make changes on a feature branch, locally, with your own subscription.
Never straight to production — a branch and a PR, always.
Typecheck · lint · boundaries · 40+ tests · build · browser QA. All must be green.
A private preview URL is built for that exact change to click through.
A human on our side reviews it and runs the full browser QA against the preview.
Only green + approved merges to main, which auto-deploys. Rollback is instant.
A CLAUDE.md file ships in the codebase. Every Claude Code session — yours or ours — automatically follows the same hard rules: never expose a write tool to the model, never weaken the tenant firewall, respect the module boundaries.
Every pull request runs typecheck, lint, module-boundary checks, 40+ unit tests, a production build, and a full browser QA pass. Red means it cannot merge — no exceptions, no human override needed.
Only a green, QA-approved change merges to the main branch, which auto-deploys to production. If anything looks wrong, rollback is instant.
Numbers are computed deterministically and the AI only narrates them — so it can't cite a wrong figure. Trust is the product.
Nightly precompute, caching, and small-model routing mean most answers barely touch the AI. ~$0 to test; a small, capped bill in production.
Real deal actions run only behind envelopes, human approval, undo, and a full audit trail — the hardest part, built first.
New behaviours are data and small modules, not rewrites — so you and Claude Code can extend it safely, fast, between our releases.