A multi-company customer-service operating system: channels, specialist agents, RAG, Tools, service cards, governed learning, and human teams working as one.
Architecture, modules and interaction map
Omnichannel
Omnichannel goes beyond a chatbot. It is a portable service operation built around Chatwoot and an AI Gateway, with five specialist roles, verified business sources, structured customer context, auditable human handoff, and continuous improvement under human control.
Every incoming interaction is bound to a company and channel before it reaches memory, knowledge, Tools or an AI provider. The response returns through the same channel or becomes a qualified human handoff.
End-to-end architecture
Customer channels
WhatsApp
Instagram / Facebook
Website / API
→
ChatwootUnified inbox, contacts, teams and operators
AI GatewayTenant resolution, state, policy and orchestration
Specialist routerIntent + retained context
Quality GateGrounding and safety
Audit logProvider, latency, cost and sources
↔
PostgreSQL + pgvectorConversations, prompts, RAG and metrics
Tools / business APIsCustomer, stock, warranty, orders and scheduling
Private data rootExports, imports, attachments and portable state
Channel → authenticated tenant → specialist orchestration → verified sources → reply or human handoff.
Runtime
What happens to one customer message
The path is deterministic around identity and evidence, while AI is used only inside controlled boundaries.
What happens to one customer message
ReceiveChatwoot emits a message_created webhook.
ValidateTenant ID, webhook secret, account and inbox are checked.
SerializeMessages from the same conversation enter one ordered queue.
RouteIntent selects Intake, Sales, Customer Care or Technical.
EnrichConfirmed fields, Tool results and tenant RAG build context.
GenerateAllowed providers run by priority with sequential fallback.
GuardQuality rules block unsupported facts and unsafe promises.
DeliverReply in the original channel or hand off with the card filled.
Agent graph
One bot, five internal specialties
The customer sees one continuous identity. Internally, deterministic routing preserves context and moves only when explicit intent changes.
One bot, five internal specialties
Quality is internal-only: customer text cannot route itself into the reviewer role.
Knowledge
RAG ingestion and retrieval
The same tenant knowledge supports every allowed provider. Corpus versioning invalidates stale cache entries automatically.
RAG ingestion and retrieval
Ingestion pipeline
XLSX / PDF / DOCX / MD / TXT / HTML→Loader→Normalizer→Overlapping chunks→384D embeddings→pgvector + corpus version
Hybrid ranking combines 72% vector similarity with 28% lexical signals. Every query, cache key, document, chunk and embedding includes the tenant scope.
Governed improvement
Learning without uncontrolled self-modification
Real conversations become evidence, not immediate instructions. Behaviour can improve only after consolidation and explicit review; factual claims still require an official source.
Learning without uncontrolled self-modification
01ConversationMessages and active specialty
02EvidenceVerified outcome, order or payment
03AssessmentHuman feedback + deterministic rubric
04CandidateSignals consolidated by tactic and specialty
05Grounding gateCommercial facts require Tool, rule or RAG
06Human reviewApprove, reject or reopen
07DatasetPII-redacted, deduplicated and versioned
08Prompt candidateSystem, Sales, Support and Post-sale bundle
09CanaryDeterministic conversation bucket
10Promote / rollbackAudited release control
8conversations
5distinct customers
3verified outcomes
4supporting signals
72%minimum confidence
≤25%contradiction
The platform does not train provider models automatically and never lets conversation repetition validate prices, discounts, warranties or policy.
Multi-tenancy
Shared capacity, isolated business context
The platform shares infrastructure deliberately. Business identity and data never become global.
Shared capacity, isolated business context
Shared platform
Gateway and Admin
Chatwoot infrastructure
Provider configurations
Scope ALL or SELECTED
Tenant A
Identity and bot
Channels and credentials
RAG, rules and prompts
Conversations and cards
Logs, outcomes and datasets
Tenant B
Identity and bot
Channels and credentials
RAG, rules and prompts
Conversations and cards
Logs, outcomes and datasets
Changing a browser header does not grant access. The backend resolves the authenticated user-to-tenant relationship and denies unknown, inactive or unauthorized IDs by default.
Business integrations
Tools turn answers into verified operations
Adapters normalize business systems without embedding company logic in the model. A timeout and response contract keeps unavailable integrations from becoming invented answers.
Tools turn answers into verified operations
Customer lookupRecognize returning customers and recover allowed context.
Products and stockConfirm catalog, availability and conditions.
WarrantyCheck coverage and official policy.
Service ordersRead status and recent service history.
SchedulingQuery availability and qualify a request before handoff.
Orders and paymentsAttach verified commercial evidence to outcomes.
1. ToolLive verified business data
→
2. Tenant RAGOfficial indexed knowledge
→
3. Constrained answerOnly what evidence supports
Interface mockups
Operational control and customer experience
The Admin explains what the system knows and why. Chatwoot keeps the operator inside a familiar inbox while AI enriches the conversation in the background.
Omnichannel Admin
Omnichannel AdminTenant Alpha
12active conversations
94%grounded replies
3providers healthy
SourceStatusChunks
Service catalogReady428
PoliciesReady96
Quick repliesReady184
Chatwoot● online
Customer conversation
Hi, I need help with my device.
Of course. Which model and what symptom are you seeing?
It is a phone that stopped charging.
Thanks. I recorded the symptom; tell me the exact model so I can continue safely.
Type a message…
Service card
The conversation fills a structured handoff
Confirmed fields accumulate without forcing the customer to repeat information. When scheduling is requested, missing data is collected before a human receives the case.
Service card #8421Collecting data
Conversation ID#8421
NameConfirmed
PhoneConfirmed
CPF / e-mailWhen needed
Device / modelCaptured
Service / symptomCaptured
Desired unitPending
Date and timePending
Appointment IDAfter integration
StatusIn service
Persistence
Portable application, separate private data
The reusable source can be distributed without company identity. Configuration, tenant files and database state live in a sibling private root that can be exported and restored.
Portable application, separate private data
Application repository
GatewayRuntime and integrations
AdminConfiguration interface
ComposeServices and networking
Docs and testsContracts and validation
⇄
Private data root
configInfrastructure secrets
tenantsRAG, rules, contacts, cards and datasets
imports / exportsLarge conversation archives
state / backupsPortable databases and volumes
Manual startup can download the private state; graceful stop can snapshot it. Nothing needs to start automatically with Windows.
Trust and observability
Controls around every decision
The platform records enough operational evidence to investigate an answer without exposing secrets or raw model reasoning.
Prompt securityUntrusted customer and historical text is sanitized and wrapped as data, never as system instruction.
IdempotencyTenant plus external IDs prevent duplicate conversations, messages and verified links.
Provider fallbackOnly enabled and tenant-authorized configurations participate, ordered by priority.
GroundingTools and official RAG take precedence; unsupported claims can be blocked.
AuditabilityProvider, model, prompt version, RAG sources, latency, tokens, cost and errors are attributed to the tenant.
Human controlTransfers, learning approval, dataset publication, canary promotion and rollback remain explicit actions.
Built as an operating system for service, not a single bot
The result is a modular foundation that can be copied to a new organization as clean software, then configured through its private tenant data and integrations—without carrying another company’s identity, conversations or knowledge.