Skip to content
Bryan Silva
04multi-agent-assistantAll case studies

Agentic architecture · Human-in-the-loop

Multi-agent personal assistant

A WhatsApp assistant that handles calendar, tasks and meeting actions, secure by construction.

Status
In production
Role
Architecture and development
Stack
  • n8n
  • OpenAI
  • Gemini
  • Whisper
  • Postgres
  • Redis
  • Google Calendar
  • Google Drive
  • Evolution API
  • Notion

Results

workflows
8
tables
7
of crons in < 1 s
~95%

Problem

Calendar, tasks and meeting actions were scattered, and everything depended on manual logging.

Solution

A WhatsApp assistant (text or audio) with access to the calendar and a Notion task board; it sends daily and weekly summaries at the client's time and turns meeting transcripts into tasks and events with no intervention.

How it works

  1. 01Trigger

    WhatsApp

    Text or audio (Whisper), with debounce and a circuit breaker.

  2. 02AI

    Central agent

    GPT-4.1 mini with Gemini as fallback; only talks to sub-workflows.

  3. 03Process

    Sub-workflows

    Each tool holds its own credential and serves both the agent and the crons.

  4. 04Trigger

    Crons and transcripts

    Summaries at the client's time; Drive meetings become tasks.

  5. 05Process

    Human confirmation

    Risky actions require confirmation; forbidden ones don't exist.

  6. 06Output

    Calendar and tasks

    Google Calendar and the Notion task board.

Inside the system

multi-agent-assistant/core-agent
n8n central agent workflow: WhatsApp webhook, anti-echo, circuit breaker, audio transcription, buffer and agent with tools

Central agent workflow

multi-agent-assistant/tools
Calendar sub-workflow: client record lookup, guard, routing by risk class and Google Calendar actions

Calendar sub-workflow (tool)

Technical decisions

  • One tool, two consumers. The agent never talks to external APIs, only to sub-workflows; the credential lives in the tool, which also serves the crons.
  • Secure by construction. Actions are classified as safe, risky or forbidden; destructive ones don't exist in the graph without confirmation.
  • Fixed destination. The sender ignores the destination the LLM asks for and only uses the client record, closing the door to hallucination and prompt injection.
  • Channel protection. Debounce, circuit breaker (12 msg/min) and anti-echo with Redis.
  • Idempotency. Atomic claim (INSERT … ON CONFLICT) and 3-layer dedupe on transcripts.
  • Ambiguity becomes a task. An ambiguous time never becomes an event: it becomes a “schedule a time” task.
  • Proven multi-tenancy. Switching clients requires no node edits.
  • Observability. Tokens, model and tools logged per interaction as a pricing basis; a test harness for the allowlists.

Result

Calendar, tasks and meeting actions in one place, with no manual logging, and dangerous actions locked by construction.