Project 5 — Enterprise AI Assistant

Project 5 — the enterprise AI assistant — is the SSO, the RBAC, the audit, and the grounding inside the enterprise firewall (L385) — the scope (the enterprise L385: the employees L162, the data L313, the firewall L263, L385), the architecture (the assistant L378: the golden path L378; the security L325: the stack L325, L385), and the build (the SSO L385: the SAML and the OIDC L239; the RBAC L241: the roles L241 and the scopes L262; the grounding L280: the internal knowledge L349; and the audit L322: the record L322, L385) — the enterprise's (L380) proof (L385).

The one-sentence interview answer: "Project 5 is the enterprise assistant, built inside the firewall (L385). The scope (L385): the enterprise (L385) — the employees (L162), the data (L313) — the internal (L385) documents (L349); and the firewall (L263) — the private (L263) deployment (L385). The architecture (L385): the assistant (L378) — the golden path (L378) with the guardrails (L373); and the security (L325) — the L325 stack (L325): the identity (L385), the authorization (L241), the audit (L322). The build (L385): the SSO (L385) — the SAML (L385) and the OIDC (L239): the corporate (L385) identity (L385); the RBAC (L241) — the roles (L241): the employee (L241), the manager (L241), the admin (L241) — the scopes (L262); the grounding (L280) — the internal (L385) knowledge (L349) with the citations (L192); and the audit (L322) — the who, the what, the when (L322) — the compliance (L371) record (L385). The AI shape (L173): the enterprise (L385) — the SSO (L385), the RBAC (L241), the grounding (L280), and the audit (L322) — the L380 enterprise (L380), proofed (L385)."

Think of the enterprise assistant as the corporation's private concierge. The concierge (the assistant, L385) serves the employees (L162) inside the corporate campus (the firewall, L263): the badge (the SSO, L385) — the corporate (L385) ID (L385); the access levels (the RBAC, L241) — the employee (L241), the manager (L241), the admin (L241); the reference library (the grounding, L280) — the internal (L385) documents (L349) with the citations (L192); and the logbook (the audit, L322) — every request (L322) recorded. The campus works because the badge is corporate, the levels are scoped, the library is internal, and the logbook is kept (L385).

   the private concierge (the assistant, L385)
   ┌────────────────────────────────────────────────────────┐
   │ the badge (the SSO, L385) · the levels (the RBAC, L241)│
   │ the library (the grounding, L280) · the logbook (the   │
   │ audit, L322) · the campus (the firewall, L263)         │
   └────────────────────────────────────────────────────────┘

The mental model is the concierge: the badge, the levels, and the logbook (L385).

   THE SCOPE (L385) → the enterprise (L385)
        │
        ▼
   THE IDENTITY (L385) → the SSO (L385): the SAML (L385), the OIDC (L239)
        │
        ▼
   THE AUTHORIZATION (L241) → the RBAC (L241): the roles (L241), the scopes (L262)
        │
        ▼
   THE GROUNDING (L280) → the internal (L385) knowledge (L349) + the citations (L192)
        │
        ▼
   THE AUDIT (L322) → the who, the what, the when (L322)

The flow is the build: scope → SSO → RBAC → grounding → audit (L385).

• The scope (L385). The enterprise (L385): the employees (L162), the data (L313), the firewall (L263).
• The architecture (L385). The assistant (L378) and the security (L325).
• The SSO (L385). The identity (L385): the SAML (L385) and the OIDC (L239).
• The RBAC (L241). The authorization (L241): the roles (L241) and the scopes (L262).
• The build (L385). The grounding (L280) and the audit (L322).

• The portfolio (L103). Project 5 (L385) — the L380 proof (L385).
• An interview (L385). The walkthrough (L385) — the SSO to the audit (L385).
• An enterprise copilot (L378). The internal (L385) assistant (L385) — the golden path (L378).
• A regulated enterprise (L371). The audit (L322) — the SOC 2 (L371) evidence (L385).
• Anything enterprise (L380). The capstone (L385) — the SSO, the RBAC, the grounding, the audit (L385).

The through-line: the proof is the enterprise's — the identity, the roles, the grounding, and the audit (L385).

Say it in four moves:

1. The scope. "The employees (L162), the data (L313), the firewall (L263)."
2. The SSO. "The SAML (L385) and the OIDC (L239) — the corporate identity (L385)."
3. The RBAC. "The roles (L241) and the scopes (L262)."
4. The build. "The grounding (L280) and the audit (L322)."

• The SSO is the identity's (L385). The corporate (L385) ID (L385) — the SAML (L385) and the OIDC (L239) — the one identity (L385) across the enterprise (L380).
• The RBAC is the least privilege (L241). The roles (L241) — the employee (L241) reads (L241), the manager (L241) approves (L324) — the scopes (L262) (L385).
• The grounding is the private (L280). The internal (L385) knowledge (L349) — the citations (L192) — the private (L385) RAG (L349) inside the firewall (L263).
• The audit is the compliance (L322). The who, the what, the when (L322) — the SOC 2 (L371) — the L322 record (L322), built (L385).
• The deployment is the private (L385). The VPC (L263) — the firewall (L263) — the private (L385) cloud (L366) or the on-prem (L377).

• The public copilot (L385). The assistant (L385) without the SSO (L385) — the identity (L385) missing (L385).
• The wide roles (L241). The admin (L241) for everyone (L241) — the RBAC (L241) — the least privilege (L262) (L385).
• The un-grounded (L280). The public model (L278) answering (L336) — the internal (L385) knowledge (L349) with the citations (L192) (L385).
• The un-audited (L322). The requests (L322) un-recorded (L322) — the SOC 2 (L371) (L385).
• The public deployment (L385). The assistant (L385) outside the firewall (L263) — the private (L385) deployment (L385).

• SSO the identity (L385) — the SAML (L385) and the OIDC (L239).
• RBAC the roles (L241) — the scopes (L262), the least privilege (L314).
• Ground the internal (L280) — the private (L385) knowledge (L349) with the citations (L192).
• Audit everything (L322) — the SOC 2 (L371) record (L385).
• Deploy privately (L385) — the VPC (L263) inside the firewall (L385).

Q: Walk me through Project 5.

A: The enterprise assistant, built inside the firewall (L385). The scope — the employees (L162), the data (L313), the firewall (L263). The SSO — the SAML (L385) and the OIDC (L239). The RBAC — the roles (L241) and the scopes (L262). And the build — the grounding (L280) and the audit (L322).

Q: How does the SSO work?

A: The corporate identity (L385): the SAML (L385) or the OIDC (L239) — the employee's (L162) corporate (L385) ID (L385) — the sessions (L237) in the store (L268). The one identity (L385) across the enterprise (L380) — the L239 OIDC (L239), built (L385).

Q: How does the grounding work?

A: The private RAG (L349): the internal (L385) documents (L349) ingested (L176) into the private (L385) index (L183) — the retrieval (L189) with the citations (L192) — the answers (L337) grounded (L337) in the internal (L385) knowledge (L385). The public model (L278) with the private (L385) context (L385).

Q: How do you deploy it?

A: The private (L385): the VPC (L263) inside the firewall (L263) — the private (L385) cloud (L366) or the on-prem (L377); the model (L278) via the private (L385) endpoints (L263); and the data (L313) in the region (L261) — the L371 compliance (L371), built (L385).

• What's the scope (L385)?
• How does the SSO work (L385)?
• How does the grounding work (L280)?
• How do you deploy it (L385)?
• What's the arc (L385)?

The senior read: the right column is the capstone — the enterprise, built (L385).

// Project 5 (L385) — the enterprise assistant (L385).
// 1 · THE SSO (L385) — the corporate identity (L385).
async function authenticate(req) {
  // the SAML (L385) or the OIDC (L239) — the corporate ID (L385).
  const identity = await oidc.verify(req.token);     // L239, L385
  return { employeeId: identity.sub, groups: identity.groups };
}

// 2 · THE RBAC (L241) — the roles and the scopes (L262).
const roles = {
  employee: ['read:docs'],                          // L241
  manager:  ['read:docs', 'approve:refund'],        // L241, L324
  admin:    ['read:docs', 'write:index'],           // L241
};

// 3 · THE GROUNDING (L280) — the private RAG (L385).
async function answer(identity, query) {
  authorize(identity, 'read:docs');                 // L241
  const chunks = await internalRetrieve(query);     // the internal (L349, L385)
  return { answer: await model.invoke({ query, context: chunks }),
           citations: chunks.map((c) => c.source) };    // L192, L337
}

// 4 · THE AUDIT (L322) — the compliance record (L385).
await audit.log({ employeeId, queryHash, tokens, at: Date.now() });  // L322

// 5 · THE DEPLOYMENT (L385) — the VPC (L263) inside the firewall (L385).
//   the private (L385) cloud (L366) · the private endpoints (L263)

What the reader must SEE — the build, started:

  oidc.verify                → the SSO (L239, L385)
  the roles and the scopes   → the RBAC (L241, L262)
  internalRetrieve + citations → the grounding (L280, L192)
  audit.log                  → the record (L322)
  the VPC + the endpoints    → the private deployment (L263, L385)

  The SSO, the RBAC, the grounding, the audit (L385).

• The SSO is the session's (L385). The OIDC (L239) — the token (L239) and the session (L237) — the sub-second (L385).
• The grounding is the TTFT (L280). The internal (L349) retrieval (L189) — the sub-second (L151) (L385).
• The audit is the storage (L322). The records (L322) — the retention (L322) — the SOC 2 (L371) (L385).
• The deployment is the private's (L385). The VPC (L263) — the endpoints (L263) — the latency (L333) inside (L385).

• Project 5 = the enterprise's proof (L385): the scope, the SSO, the RBAC, the build.
• The scope: the employees (L162), the data (L313), the firewall (L263).
• The SSO: the SAML (L385) and the OIDC (L239).
• The RBAC: the roles (L241) and the scopes (L262).
• The build: the grounding (L280) and the audit (L322).

PROJECT 5: ENTERPRISE AI ASSISTANT = inside the firewall

THE SCOPE (L385)
  the employees (L162) · the data (L313) — the internal (L385)
  the firewall (L263) — the private (L385) deployment (L385)

THE SSO (L385)
  the SAML (L385) · the OIDC (L239) — the corporate (L385)
  identity (L385) · the sessions (L237)

THE RBAC (L241)
  the roles (L241) — the employee (L241), the manager (L241),
  the admin (L241)
  the scopes (L262) — the least privilege (L314)

THE GROUNDING (L280)
  the private (L385) RAG (L349) — the internal (L385) documents
  the retrieval (L189) with the citations (L192)
  the answers (L337) grounded (L337)

THE AUDIT (L322)
  the who, the what, the when (L322) — the SOC 2 (L371) record (L385)

THE DEPLOYMENT (L385)
  the VPC (L263) inside the firewall (L263)
  the private (L385) cloud (L366) or the on-prem (L377)

INTERVIEW, 4 MOVES
  1 scope   "the employees, the data, the firewall (L385)"
  2 SSO     "the SAML and the OIDC (L385)"
  3 RBAC    "the roles and the scopes (L241)"
  4 build   "the grounding and the audit (L385)"

You now hold the fifth proof: the SSO, the RBAC, the grounding, and the audit — with the corporate badge and the internal library. The private concierge serves the campus — and the logbook is kept (L385).

Next: the capstone of the capstones — the complete AI Solutions Architecture Case Study (L386).