Building Ariyes Office: hiring AI employees, carefully

Most AI automation today is a pile of workflows: a trigger here, a prompt there, a spreadsheet in the middle. It works until you have several of them, for several clients, and nobody can say who did what, with whose data, and who agreed to it.

Ariyes Office is my attempt at something more permanent: a platform where each company gets a private virtual office. It has departments and rooms, AI managers and specialists, and the tasks, conversations, approvals and history you'd expect from a real team. You walk into a department and talk to the manager.

It's early. After six days the foundation is built and tested, but nothing is deployed and no AI employee is doing real work yet.

An employee, not a workflow

The core idea is that an AI employee is made of versioned configuration, not a copied workflow:

• a reusable template for the role, like a sales researcher
• the company's own employee, with a job description, objectives, KPIs, schedule, reporting line and limits
• capabilities tied to specific, approved workflow versions
• the company's own knowledge and connections, kept separate from every other company's
• guardrails: what tools it may use, what needs approval, and how much it may spend

That makes AI employees comparable, auditable and safe to change. A change creates a new version instead of rewriting the old one, so it's always clear what an employee was set up to do.

People approve what matters

An AI employee can read the company's records, research the public web, sort leads and draft emails on its own. Sending an email, publishing, spending money, or deleting data needs a person's approval. Legal and complaint replies always go to a person, and anything behind a CAPTCHA is done by a person, never bypassed.

An approval covers the exact action and content, so editing an approved email cancels the approval. And text an agent reads from a website, an email or a tool is treated as data, never as instructions. That one rule shuts the door on a whole class of attacks.

Security first, screens second

The first week went almost entirely into foundations nobody sees:

• Every business request runs inside the company's own row-level-secured database transaction, so the database itself refuses to show one company another company's data.
• Every API route has to be declared as public, sign-in or business. An undeclared route never runs.
• Work runs as durable jobs with leases, retries and an append-only history, so it survives restarts and every attempt is recorded.

The screens that exist so far are the sign-in, the Office shell and the start of the Admin Control Panel, where staff manage companies.

Two AI agents, one owner

Ariyes Office is built by two AI agents with separate jobs. Codex is the architect and reviewer: it writes one numbered prompt for each milestone and reviews what comes back. Claude Code implements the prompt and reports exactly which checks ran and what they returned. I make the product decisions and accept each milestone.

The review step earns its keep. Of the 27 prompts so far, 14 are focused fix-ups written after a review found a gap, like an error that leaked too much detail or a check that ran in the wrong order. Catching those in week one is much cheaper than finding them in production.

What's next

Next come the Office's first real business pages, the first AI providers and capabilities, and a pilot department inside one of my own businesses.