An assistant that can’t overcharge

A traveller asks in their own language. The assistant searches hotels and places, reads travel guidance, and, once the traveller has chosen, offers add-ons such as an eSIM or an airport transfer before building a trip pack. A traveller who wants a multi-component package is guided through the site’s existing package builder instead.

The trip pack is the payment envelope. The server prices it, holds it, and returns a pay link to the site’s existing checkout. The chat never opens a payment session, and payment reuses the per-item fulfilment the platform already had rather than a new path.

Beyond writing text, everything the model does goes through typed tools: more than 20 across search, owned bookings, add-ons, editable draft packs, packages, places and handoff. Which tools it is offered depends on sign-in and configuration: place tools appear only when place search is configured, and anonymous visitors are not offered tools that read their bookings or write to a pack.

Identity comes from the signed-in session on the server, not from anything the model says. Searching and reading guidance stay open; looking up your own bookings and writing to a pack or draft require sign-in.

Each caller gets 20 requests a minute. The limiter fails closed: if it cannot be enforced, chat requests are refused rather than let through, because this endpoint calls a metered model.

Inside a turn, the model gets at most 12 steps and 60 s. A read tool that runs past 30 s stops holding the reply: the tool tells the model to say the lookup did not come back in time rather than report no results, while the underlying query may still finish in the background.

Five write tools are deliberately exempt. Stopping the wait would not stop the write, and telling a traveller that a pack change timed out could lead them to make it twice. Prices are checked on the server before a pack is saved, and the tool returns the saved total; the model writes the conversation, but the server is the source of truth for price.

The assistant was specified in written designs before implementation. One revision changed the final step: an earlier design ended with the chat handing out a payment-provider link for a single hotel booking; the revised design made the trip pack the payment envelope, so add-ons share one payment and checkout stays outside the chat.

The assistant has 15+ service test files, including tests that pin the system prompt’s rules and language behaviour. They test rules and tools; they do not measure model quality.