Each customer uploads their own material, asks questions about it, and never sees anyone else's. The upload, the conversion, the search, the chat and the citations are already built. The part that usually goes wrong is the isolation, and here that is enforced by tests rather than by everyone remembering.
With no API key configured. The AI runs on the Cloudflare binding until you give it something better.
PDFs, Word, Excel, OpenDocument, HTML and plain text. The original goes to object storage and stays downloadable. Anything that is not already text is converted in a background job, so a large upload does not hold a request open.
Two searches run at once: one on meaning, one on the words themselves, and the results are merged. A hit carries the passage and where it sits in the document, so a citation can link into the text rather than at it.
The assistant can search the knowledge base, open a document and list what is indexed. The thread is stored, so a customer can come back to it, and a long one is summarised rather than silently truncated.
A research agent reads what it needs, answers, and cites the documents it used. Citations are filtered against the documents it actually opened, so an invented source is dropped instead of shown.
Every model call writes a row with the provider, the model, the tokens and an estimated cost. When a customer asks what their AI usage is costing you, the answer is a query.
Groups let one customer restrict a document to a department rather than the whole organisation. A document nobody may see returns the same not found as one that does not exist.
Every row belongs to an organisation, and every query filters by the organisation on the signed in session rather than anything the browser sent. That is the rule. The reason to believe it is not that the rule exists, because rules like this are broken by the query somebody adds in a hurry six months from now.
It holds because a test reads the code and fails when a query touches a table with an organisation key without naming one, and because the search, the chat tools and the agent tools all go through a single function that takes the reader's access and applies it. An agent reads exactly what the person who started it may read, worked out when it runs rather than when it was queued.
How tenancy and access work
A run that is about to do something consequential can pause, ask, and wait. It can wait for days.
That matters in a portal, because the useful version of this is rarely just answering questions. It is drafting the reply, filing the claim, or writing the summary back into the customer's own records. Approval is part of the run rather than a screen you bolt on afterwards, and the answer is recorded next to the question.
How agents work hereUpload something real on the Knowledge page and watch it move from indexing to indexed. Then search a phrase from the middle of it.
Run the research agent against a question only that document can answer, and read the citation it comes back with.
Create a second organisation, upload a different document, and try to reach the first one from it. This is the five minutes that tells you whether the isolation story is real.
It runs on Workers AI with no key. Add an Anthropic or OpenAI key in settings when you want a different model, per organisation or for everyone.