Container images on Azure
- Hosting
- Frontend and backend images from Azure Container Registry. [Replace: confirm live hosting with the infrastructure owner]
- Sign-in
- Microsoft Entra ID single sign-on
- Data
- Azure Database for PostgreSQL
The platform
One sign-in, one project workspace and 17 tools.
{{product.name}} is a web app for strategy teams. It keeps the inputs, AI outputs, reviews and approvals for each project in one place.
[Replace: screen recording of a tool run]
A project with {{product.name}}
- 1Create a project
Add the project details and the team. You become the project lead.
- 2Run a tool or a bundle
Fill in the input form and watch the output stream in. A bundle runs several tools in sequence.
- 3Review and approve
Comment, edit, regenerate with feedback, then approve the output you want to keep.
- 4Chain and export
Approved outputs feed dependent tools and the Summary page, which exports to PowerPoint.
How it is built
The frontend is the security boundary for everything behind it.
Every request passes through the Next.js server, which checks the session before it calls the API or a model. The API trusts the user id the frontend sends, so it must stay on the internal network.
- Next.js 16 and React 19, with pages for projects, tools, bundles, the summary and admin.
- The active project is held in one shared context.
- PowerPoint files are built in the browser, not on a server.
- NextAuth checks the session on every API route.
- The AI proxy is the only place that holds model credentials. It checks the model against an allowlist and streams the response.
- Thin proxies forward project calls with the user id.
- An Express API with Prisma stores users, projects, members, tool runs, comments and edits.
- It checks project membership and records each sign-in in an access log.
- It trusts the user id from the frontend, so it is not exposed publicly.
- Microsoft Entra ID handles single sign-on in production.
- Models come from Azure AI Foundry or the Anthropic API. Foundry takes priority when both are set.
- The set of allowed models is configuration, not code.
Ways to run it
The same code runs in production, on a laptop and against either model provider.
Settings decide how the suite signs people in and which model it calls. Some settings are fixed when the frontend image is built, and others change at runtime.
Run both services on a laptop
- Needs
- Node.js 20 or later and a PostgreSQL database
- Sign-in
- A dev user, using the first admin email
- Command
- npm run dev starts the frontend and backend
Azure AI Foundry or Anthropic
- Choice
- Set by which credentials are configured
- Allowlist
- Only listed models can be called
- Tiers
- Tools use a standard, deep or fast model tier
Six design choices keep the suite governed.
These choices come from how the suite is built today. [Replace: confirm with the security and Legal contacts before quoting them to anyone outside the team.]
The frontend is the security boundary.
Only the frontend sets the user id the API trusts. The API stays on the internal network.
A person approves before work chains.
Only approved outputs become context for later tools or appear in the summary.
Credentials stay on the server.
Model keys live in the AI proxy and are never sent to the browser.
Model choice is configuration.
An allowlist decides which models can be called, and tools name a tier, not a model.
Changes are recorded.
Each edit keeps the text before and after. Comments are stored with their author, and sign-ins are logged for admins.
Exports stay in the browser.
The PowerPoint is built in the browser and nothing is generated on a server.