Failure mode 1
Bolt-on AI
AI is added around processes that still live in spreadsheets, inboxes and applications nobody can change. With no system of record, rules or permissions to work inside, it never gets trusted with work that matters.
The Bondi platform
AI does the work. People make the calls. Your team owns the system.
Bondi is the build-and-own alternative to managed AI transformation. Your team builds the complete system: data, screens, permissions and, on Pro, portals. AI steps and people's decisions run in the same workflow, and changes ship through review.
- Dedicated database per environment
- EU-hosted databases
- Published pricing
bondi / platform Platform map
01 · The system
Build the system
The data, screens and portals your operation runs on, built by your own team with AI Builder.
- AI Builder Describe the operation. AI Builder builds the first version, then proposes changes to data, screens, rules and workflows as plans you approve before they apply.
- Architecture & data A dedicated PostgreSQL database per environment, rules enforced in the write, record changes audited in the same transaction, and an API for the rest of your stack.
- Apps & portals Role-specific screens, dashboards, documents and external portals on one set of records, with access set by role.
02 · The work
Run the work
AI steps, human decisions and connected systems in the same durable run.
- AI & human decisions AI steps read, classify and act inside your workflows. A rule sends each judgment call to the assigned person or role, and the same run continues.
- Workflows A durable workflow engine for triggers, AI, people and data, with retries and error paths per step and transactions across steps.
- Integrations 14 built-in providers with 539 typed actions and 177 event triggers, plus the HTTP step and custom integrations for systems without a built-in provider.
03 · Boundaries and history
Govern the change
Access, security and releases that keep a live system safe while it keeps changing.
- Access control Roles that start from the screens a job uses and extend to rows, fields and related records, for people, portals and integrations.
- Releases & change control A Development copy of Production on Pro, one reviewed change set, and a release refused when either side changed after your review.
- Security Tenant isolation, EU-hosted databases, encrypted secrets and a same-transaction audit, stated control by control.
Foundation
- 22 built-in data types
- 11 rule types enforced on write
- Audit in the same transaction
- GraphQL · REST · OpenAPI 3.1
Our point of view
Transformation you own beats transformation you rent.
Two patterns stall AI programs in operations. The four principles below are how Bondi avoids both.
Failure mode 2
Rented transformation
A vendor's team designs, builds and runs the new system. It works until the process changes; then every change is another engagement, and the knowledge of how your operation runs sits outside your company.
-
Your team builds and owns the system.
AI Builder turns a description into data, screens, rules and roles, then proposes workflows and further changes as plans you approve. Your system runs on a dedicated PostgreSQL database with a documented GraphQL and REST API, and on Pro the organization owner can export your tables as a standard PostgreSQL dump.
AI Builder -
AI works inside the rules.
A workflow's AI agent has no database tool. Records change in the data steps your team places around it, with 11 rule types enforced inside the write transaction.
Architecture & data -
People make the calls.
A rule you set, such as a confidence threshold, sends the case to a form assigned to a named person or role, with the reason, the record and the decisions open to them. The same run waits, a Switch on their answer picks the next branch, and a task with a deadline takes its expired branch if nobody answers.
AI & human decisions -
One reviewed change set, from Development to Production.
On Pro, build the change in a Development copy of Production, review it as one change set, and publish a release that is refused if either side changed after your review.
Releases & change control
Anatomy of a run
One supplier, one run, every step on the record.
Procurement submits a supplier's onboarding documents. AI reads them field by field, a confidence rule sends the one uncertain field to the Procurement lead, and the same run writes the result under your business rules.
procurement / supplier-onboarding · run 3307 Diagram
-
Form trigger
Procurement submits onboarding
The onboarding form starts the run with the supplier's details and one PDF holding the bank letter and VAT certificate.
-
Structured document extraction
AI reads the supplier's PDF
Structured extraction returns each field with its own confidence score.
- Account holder
- Kestrel Components GmbH
- 0.97
- Bank
- Commerzbank
- 0.95
- Account
- DE44 •••• 1809
- 0.93
- VAT number
- DE3148•••
- 0.58
- Below threshold: needs a person
-
Resolve Record
Is this a supplier we already have?
The supplier's domain matches exactly one supplier record, the one created at first contact, so it resolves without a person.
- Ambiguous match → a reviewer chooses from record previews
-
If
A confidence rule checks each field
Fields read below 0.90 confidence need a person. Only the VAT number is below it.
- Every field ≥ 0.90 → write without a review
-
Interactive form (a person decides)
Procurement checks the VAT number
The run waits for the assigned role, with the one uncertain field in front of them.
Assigned to Procurement lead (role)
Decision required
Why the run paused: The VAT number was read with 0.58 confidence, below the 0.90 this process requires.
Kestrel Components GmbH · the extracted VAT number as an editable field · the source document
Permitted decisions
- Approve with the corrected VAT number
- Request a new document
On submit, the same run resumes, and a Switch on the chosen decision sets its next branch.
No answer in 48 hours: the Expired branch opens a new task for the procurement manager.
-
Transaction
The same run finishes the job
Supplier, bank details and onboarding checklist commit in one transaction, or not at all. Business rules are checked inside that transaction.
-
Record history
The change is in the record's history
Audit rows are written inside that same transaction. For this update, the row holds the actor and each changed value, before and after. Who decided stays on the completed task in run 3307.
- actor
- Automation: Supplier onboarding
- table
- suppliers
- operation
- update
- vat_number
- ∅ → DE314800•••
Run 3307's execution historySubmitted → extracted → matched → checked → decided by Procurement lead → written
Diagram assembled from shipped step types: a form trigger, structured document extraction with per-field confidence, Resolve Record, an If condition on field confidence, an interactive form with an Expired branch and a Switch on the decision, and a Transaction, plus the audit history those writes produce. Names and values are sample data.
Every step in this run is a shipped step type. Bring a process and we'll trace yours.
Walk through your process with usBuilt-in controls
Five controls built into the platform, not left to policy.
- 1
- dedicated PostgreSQL database for every environment
- 9
- named actions AI Builder takes outside the plan card, such as canceling one of its own running jobs after you confirm. After the first build, every other change waits for approval.
- 0
- database tools in a workflow AI agent's toolset; records change in the data steps your team places around it
- Same transaction
- for a record change and its audit row, so a rolled-back change takes its audit row with it
- 30 days
- before a removed table or column that still holds data can be purged; its values stay restorable until an owner purges it
Ownership and delivery
Whoever builds it, your team runs and changes it.
Build the first version yourself, with our team or with a partner. After that, your own people change it through the same reviewed process, without a new engagement.
What your company keeps
- Your data, in a dedicated PostgreSQL database per environment
- A documented GraphQL and REST API to that data
- A SQL export of your tables, with schema and data, taken by the organization owner (Pro)
- 30 days of viewing and export access after a subscription ends
-
Build it yourself
Your team builds and changes the system with AI Builder. Start with a 30-day trial, no card required.
Start a 30-day trial -
Build it with us
Our team scopes and delivers the first system, or the migration from a system you're replacing, as a project quoted separately from the subscription.
Scope a project with us -
Build it with a partner
Work with an implementation partner, on a platform your company keeps after the project ends.
About the partner program
| Question | A managed AI program | Bondi |
|---|---|---|
| Who builds it | The vendor's delivery team | Your team with AI Builder, with our team or a partner if you want help |
| Who changes it | The vendor, on request | Your people, through reviewed changes that your owners and admins publish |
| How it starts | A sales engagement | A 30-day trial or a conversation |
| Price | Scoped per engagement | Published per seat, with published metering |
| Where the know-how lives | With the vendor's team | In a system your team can read and change |
Change control
Change ships as a release.
On Pro, changes to tables, rules, screens and workflows (16 kinds in all) move from Development to Production as one reviewed change set. You decide each conflicting screen, rule or workflow by keeping Production or taking Development, and a release is refused if either side changed after your review. A removed table or column that still holds data can't be purged for 30 days, and stays restorable until an owner purges it.
See how releases work- Development copy of Production (Pro)
- Per-item decisions on conflicting screens, rules and workflows
- Releases refused on drift
Security
Controls your security team can check, one by one.
The four controls below are in place today. Bondi does not hold SOC 2 or ISO 27001 certification, and single sign-on and self-service multi-factor enrollment are not available yet. The security page lists each control with its status.
See every control and its status- Isolation
- Each customer has a separate database project, and each environment its own dedicated PostgreSQL database.
- Hosting
- Databases on Neon in AWS eu-central-1 and the application API in Google Cloud europe-west3, both in Frankfurt; the Data API, workflow engine, AI Builder and sign-in run as Cloudflare Workers.
- Sign-in
- Email and password or a verified Google account, bot and disposable-email checks at sign-up, and every other session signed out when a signed-in user changes their password.
- Audit
- Direct record changes made through the Data API are logged in the same transaction, with the actor and, for updates, each changed value before and after. Rows removed by a cascading delete get no audit row of their own.
Two ways to start
Plan the whole system with us. Or start with one process.
Scope the complete operational system with our team, or run one process beside the systems you already use on a 30-day trial.