RAG agents for customer service
An AI agent that sounds human and never invents.
We build and improve RAG agents for support and internal knowledge. Every answer comes from your own content, cites its source, and speaks in your customer's own register.
The engine underneath is state of the art: vector, lexical and knowledge graph, three retrieval paths converging on a single ranking, with first-tier embedding and rerank models.
How an answer is built
- 01 Permissions
- 02 Search your content
- 03 One ranking
- 04 Related documents
- 05 Best passages
- 06 Cited answer
Degraded: one search path is down, the others carry it
How to engage
We build your agent, or we fix the one you already run.
The engine is the same in both, and it is the state of the art in retrieval: vector and lexical fused by weighted RRF, plus a knowledge graph and first-tier reranking. What changes is the starting point, one begins with your documents and the other with the agent that already answers wrong.
- Build
Your agent, built end to end
For a team that has decided to put an agent in front of customers and wants it engineered, not assembled from a tutorial.
- Starts from
- Your documents and the questions they have to answer
- Runs in
- Your cloud or your own hardware
- You get
- Source, tests and runbooks in your repository
- Scope
- Fixed, in writing, before any code
What gets built
- The agent itself: on your channels, answering from your own documents, with the source attached to every claim.
- The search behind it: exact words and meaning searched together, so an error code finds the right page and so does a vague question.
- The tests that keep it honest: your real questions, a baseline next to the code, and a gate that blocks a release when quality drops.
- Consulting
The agent you already run, corrected
For a pilot that answers but answers wrong, or a bill that grew faster than the results. Changes arrive as pull requests your team reviews.
- Starts from
- Your agent and the questions it gets wrong
- Measured
- Search and answer scored separately
- You get
- Pull requests, plus the tests that prove the gain
- Scope
- Fixed, in writing, before any code
What usually changes
- The search first. Most wrong answers are the wrong passage retrieved, not a model that made something up.
- The voice. Register, jargon and answer length tuned to your customers instead of a default assistant tone.
- The bill. Caching that actually hits, a smaller model on the customer-facing answer, and the routine steps moved into ordinary code.
What we build
What the agent does, and what holds it up.
Four capabilities, each one running in production today. If a capability has no mechanism behind it, it is not on this list.
A support agent on your customer messaging channel, and an internal chat over the same content. The answer your customer reads runs on a small, fast model on purpose, and the routine steps run as ordinary code that costs nothing per message.
- One model call per turn, measured rather than assumed
- Every claim carries its source, or it never reaches the customer
- Voice notes transcribed, and silence never sent to a paid model
- A person confirms anything the agent proposes to open or change
One search runs on meaning and on exact words at the same time, then merges the two rankings. Error codes, field labels and product names are exactly where meaning-only search fails silently, and exactly what your users type.
- Meaning and exact-word search merged, not blended into one score
- A second search space behind a breaker, switched without re-indexing
- The service refuses to start if the index and the model disagree
- Tables, code blocks and diagrams never split across passages
Some answers are not in one document. We map how your content references itself from the links and your own glossary, with no model guessing at it, so the best hit pulls in what it depends on.
- Built from your links and glossary, so it is reproducible and free to rebuild
- Fixed depth with a timeout, never an open-ended search
- Each related document arrives with the reason it was pulled in
- Offered only where questions are genuinely multi-document
A published threshold table and a gate that fails a release when a metric drops. Your own real questions, versioned next to the code, with the baseline committed so a regression is a number instead of an argument.
- Scored on your own questions, never a curated demo set
- Search and answer measured separately, because they fail separately
- Judged by a model from a different family than the one answering
- Per-stage timing and per-passage scores on every request
Humanized communication
Not sounding like a bot is engineering, not luck.
40% of Brazilian consumers say they fully prefer human interaction (CX Trends 2026). Most agents use one brand voice on everyone; ours reads the register of each message and answers in kind.
-
Mirror behavior
The agent matches the formality, sentence length and vocabulary of whoever is writing to it. Short and blunt gets short and blunt; formal gets formal. Research calls this linguistic style matching, studied in written conversation since Niederhoffer and Pennebaker's 2002 paper.
-
Your customer's words
If the customer calls it a receipt and your system calls it a settlement document, the agent answers in their word and maps it to yours behind the scenes. Internal jargon stays internal.
-
Calibrated, and disclosed
Copying a customer too closely reads as unstable rather than personal, so the range is bounded: the register moves, the identity does not. And the customer is told they are talking to an agent, never left to work it out.
-
It says it does not know
When the evidence is thin, the honest output is no answer. A claim with no source fails validation before a customer sees it, and a claim citing something the search never returned is caught and counted.
-
It hands over to a person
The agent can propose a ticket. It never opens one. A person confirms, the number the customer sees is the real one, and every refusal is recorded with a reason.
-
One voice, versioned
The instruction set that defines how the agent speaks is a versioned artifact under a production label, pinned into every trace. When the voice changes, you can see which version said what.
In production
Latest systems delivered
The agent that answers on the customer channel, the retrieval engine it runs on, the curation that governs what enters the index, and the assistant that answers and drafts over a private legal corpus. This is the set we deliver, as consulting or as a build.
Systems
A first-line agent that answers customers on a messaging channel from the company's own knowledge base, plus an internal chat over the same base for the team. Every claim leaves carrying the id of the passage behind it, and a deterministic check compares each id against what the search returned. When one does not match, the violation is recorded.
- Debounce, burst grouping and per-conversation serialization resolved in one row-reservation query: a customer sends five messages in a row and gets one answer, not five.
- The turn is committed before it is sent, and the first statement in that transaction checks whether a person has just taken the conversation over, so nobody gets a bot reply after an agent steps in.
- Two-phase escalation: the agent proposes the ticket, and opening it passes only when the server finds that earlier proposal in the log, or when the customer asked for a person outright.
- support agent
- cite-then-write
- durable queue in Postgres
- two-phase escalation
- internal chat over SSE
- pinned prompt cache
The retrieval service the agents run on. One call searches by meaning and by exact words in the same index, fuses the two rankings, expands through the knowledge graph, reranks, and returns the passages with a score on each. It calls no language model and writes nothing to the data.
- The two legs are fused by weighted Reciprocal Rank Fusion rather than by averaged scores: each leg votes by position, and the weight favors the exact word, where the client's own vocabulary is what matters.
- The graph is built by deterministic parsers with no model extraction: the edges come from wiki-links, front-matter, the glossary and the diagrams already in the content.
- Two embedding spaces in separate tables, with a breaker moving traffic between them and no re-index, plus a published index contract the service refuses to start against once the format has drifted.
- hybrid search
- weighted RRF
- Apache AGE graph
- pgvector HNSW
- published index contract
- circuit breaker
The application where a person edits the content the agent answers from, with review, diff and history. Publishing is not saving: it passes the corpus lint, produces a single-file commit in git, and re-indexes only what changed.
- The corpus lint is a rule registry with no bypass parameter in its signature: an error blocks the publish, so content with a secret pasted into it never reaches the index.
- A paid re-index requires the scope the operator actually saw: the API returns the four classes of change separately, plus a token for that scope, and refuses the run once the scope has moved.
- A bulk deletion is refused before the first DELETE when the real radius crosses the limit, instead of being executed.
- corpus curation
- lint with no bypass
- git as the source of truth
- scoped re-index
- deterministic typed graph
- blast-radius guard
A dual-mode assistant over each company's own corporate-governance corpus: it answers a question citing the document that supports the answer, and it drafts the new document in the house style the organization already uses. The corpus is what governance produces, which is general meeting minutes, articles of association, bylaws, share registry books, mandates and powers of attorney.
- Two tasks over one corpus, asking and drafting: the answer cites the document behind it, and the drafted document comes out in the pattern the organization already uses rather than a generic template.
- A question about current company law is answered separately from a question about the client's own corpus, because one ages with the statute and the other ages with the document.
- Data isolated per client and no external training. On a corporate-governance corpus that is not an architectural preference, it is the condition for the corpus to enter the system at all.
- cited answers
- document drafting
- corporate-law corpus
- house style
- per-client isolation
- no external training
Security and compliance
What your security team will ask, already answered
Data residency, prompt injection, training on your content, permissions, LGPD and exit terms. Every answer names the architecture behind it.
-
Your data does not leave your perimeter
Delivery inside your own tenant or on premises is the default, not an upgrade. Search, indexing and the document map run in one database you control. For a buyer whose data cannot leave the country, that is an architecture, not a promise.
-
Retrieved content is data, never instructions
Injection attempts are rejected before any search or paid model call. Retrieved passages and uploaded files enter the prompt fenced as inert content, and image type is read from the file itself, not from what it claims to be. OWASP catalogs this as LLM01.
-
No training on your data, written into the contract
Content export to third-party tooling is off by default, and even enabled it passes a redaction step with the user identifier pseudonymised at the boundary. The architectural reason it holds is that there is nowhere for the content to go.
-
Permission-aware search, stated precisely
Search accepts an access-tag filter and, when one is present, applies it to both legs and re-checks it per related document, discarding any whose tags cannot be resolved. Wiring it to your own identity provider is engagement work, not a switch we flip.
-
The regulation, dated correctly
LGPD governs this today and no Brazilian AI statute has replaced it: PL 2338 is still a bill. The ANPD standard contractual clauses have been mandatory since 23 August 2025, though transfers to the EU can now rely on the ANPD adequacy decision of January 2026. In Europe, the Article 50 transparency duties have applied since 2 August 2026, and the Digital Omnibus, Regulation (EU) 2026/1744, pushed the high-risk obligations to 2027 and 2028.
-
Exit before entry
The index is exportable, the test set is yours and lives in your repository, the quality gate runs in your CI, and the ingestion contract is documented. A supplier who cannot be replaced is a risk.
Straight answers
Frequently asked questions
The questions that actually come up on the first call.
Almost always because the search handed the model the wrong passages, not because it hallucinated. What the market calls hallucination is, in most cases, wrong retrieval. Three different failures look identical from outside: the right passage was never retrieved, it was retrieved and ignored, or nothing relevant existed and the agent answered anyway. Measuring them separately is the first thing we do, and usually two of the three are fine.
Next step
One scoped conversation
You reach the engineers who do the work. If neither engagement is the right first step, expect to be told that on the call.
Useful to bring
- The questions your agent gets wrong, in your users' own words
- Roughly what your content is: how much, which formats, how often it changes
- Who owns the decision to grant data access