The AI never touches the database

The problem

The obvious way to build an AI SMS follow-up agent is to let the model call the database and send the text. That design fails in a way that is hard to recover from: a bad prompt, a hallucinated price, or a prompt injection inside an inbound reply all become a message the customer actually receives, under your sending number, in violation of consent rules you cannot audit. The compliance obligations around SMS — opt-out keywords, quiet hours, the 24-hour window — are deterministic legal requirements, and none of them should depend on a language model's judgement.

The build

The system is two products with one hard boundary between them. FieldOS is the system of record: lead data, the state machine, the compliance gate, the scheduler. FieldBrain is an AI service that never holds a database connection. It reads events from FieldOS, reasons about them, and returns recommendations through an authenticated API. FieldOS then validates every recommendation deterministically and synchronously before anything can reach a lead. A litmus test decided every component's side: anything that stores a record or runs a deterministic rule goes in FieldOS; anything that interprets language, scores, or chooses among valid options goes in FieldBrain. On the FieldOS side sit CSV import with E.164 normalisation, consent records, the opt-out suppression list, quiet hours with timezone resolution, and a kill switch — because legal behaviour must never route through a model. The follow-up sequence is fixed at Day 7, 10, 17, 31 and 61 from intake. The moment a lead replies the sequence ends permanently; the AI classifies and scores the reply, then either hands off to the rep or holds a guarded conversation capped at six turns, with a deterministic claim-checker blocking any price, date, or guarantee before it can send.

• —One hard boundary: the model returns recommendations, never performs actions
• —Deterministic claim-checker blocks price, date, and guarantee claims before send
• —Opt-out keywords, quiet hours, and the 24-hour rule enforced outside the model entirely

The outcome

A hallucinating or prompt-injected model can produce a bad recommendation, but it cannot produce a bad text message. Every safety rule lives on the FieldOS side, so a model outage degrades the product rather than breaking it, and the AI provider becomes a swappable component. Leads that exhaust the sequence or go quiet land in a queue the rep has to explicitly clear — nothing rots silently.