Dealership Agent
A customer-service agent for a used-car dealership, built to answer a harder question than "can it find a car": can the LLM ever be tricked into reading another customer's data? A LangGraph supervisor routes each message to one or two permission-scoped sub-agents behind an MCP tool server; identity is authenticated once at the edge and never enters a tool schema or prompt, so PostgreSQL row-level security is what actually rejects a cross-customer query, not an application-level filter or a system-prompt instruction.
Built a 71-case labelled eval set for hallucinated action claims (replies falsely confirming a cancellation or handoff that no tool result backs); a two-stage verifier raised accuracy from 0.690 to 0.901. A follow-up refinement that looked plausible measured worse on the same eval set and was reverted, documented rather than hidden. Deployed to ECS Fargate, RDS/pgvector, and an ALB via Terraform and OIDC-secured CI/CD; live verification against the running service surfaced two production-only bugs invisible to local testing.
| RLS enabled + forced | 0 rows |
| RLS disabled | every row |
| RLS re-enabled | 0 rows |