Hospitality Agent Platform — Bounded-Autonomy Guest Messaging

The challenge

Multi-property hospitality groups run guest communication 24/7 across six inboxes and several languages, and the night shift answers the same recurring questions in all of them — slow replies, missed revenue. The channels are WhatsApp, SMS, webchat, Airbnb and Booking.com, and the blocker to automating them is not language understanding, it is authority: no property director will let a generative model near refunds, cancellations, payment links or door PIN codes, because a hallucination there is a financial and safety liability, not a bad sentence. Any credible system has to be fast on the easy 70% and provably incapable of acting alone on the rest.

The solution

We built a platform where the model's authority is an explicit design decision. Every provider webhook is normalised into one canonical event envelope with a deterministic UUIDv5 event ID, verified by HMAC-SHA256 signature and a timestamp-skew replay window. A pluggable multilingual classifier covers 13 hospitality intents across eight languages and emits structured metadata — intent, calibrated confidence, rationale code — so nothing downstream ever parses free-form model prose. A fail-closed policy gate then decides: reads (FAQ, room availability) auto-approve; writes (inventory holds, refunds, cancellations, door codes) route to a human queue. LangGraph checkpointing keeps conversation lineage durable across restarts; a transactional outbox publishes at-least-once with exponential backoff and dead-letter classification, and the tool-execution worker is guarded by SHA-256 idempotency keys so a network retry cannot double-charge or double-book. State lives in seven PostgreSQL tables behind a zero-PII audit sink — door PINs and card data are never written to traces or logs. The operations console adds RBAC (operator / manager / admin, with refunds manager-only) and emergency takeover routing that pulls smoke, fire, gas and safety events out of automation entirely.

The impact

Low-risk guest questions get answered in seconds without a human; every high-risk action stops at an approval queue with the full correlation and causation chain attached, so an operator approves a decision rather than reconstructing one. Because authority lives in policy code instead of a prompt, the safety behaviour is testable: 39 automated tests covering the policy gate, RBAC boundaries, idempotency and outbox retry paths run in about 2.5 seconds. This is an internal build running against a sandbox PMS adapter — a reference implementation and a demo we can walk a prospect through end to end, not a deployed client system.

Technologies used