Key Takeaway
Chrono replaced a creator platform's advice-only AI feature with an in-app agent that makes real changes to the user's page, live with real users in under three weeks, with 398 automated tests passing and the agent held to exactly the same data permissions as the user.
A consumer creator platform already had an AI feature. It could tell users what to do with their page, but it couldn’t do any of it, and it forgot the conversation as soon as it ended. Chrono replaced it with an agent built into the creator admin that makes the changes itself. Real users had it in under three weeks. If you’re weighing whether to let an AI agent touch your customers’ data, this is how we made that safe.
What was wrong with the original AI feature?
It advised and then stopped. A creator would ask how to improve their page, get a list of suggestions, and then go make every change by hand. It also had no memory, so each session started from zero.
That’s the gap most “AI assistants” in products fall into. Users don’t want advice about their page. They want their page fixed.
What does the new agent do?
It acts on the creator’s page from inside the admin. Creators ask in plain language and the agent does the work:
- Create, edit and reorder links
- Archive links they no longer want
- Set goals and track progress against them
Every action is a typed tool with validated inputs. The agent has 17 of them, and it can’t do anything outside that list.
How do you let an agent change user data safely?
You make the agent run as the user. That was the central decision on this build, and the rest follows from it.
The app’s UI and the agent call the same query layer. Access is enforced by Row Level Security in Postgres (database rules that decide, row by row, what each signed-in user can read or change). Because the agent goes through those same rules, it can never reach data the user couldn’t reach by clicking through the UI. There’s no service-role key in the system, so there’s no back door to leak.
Three other decisions kept the risk low:
Archive, never delete. The agent can’t permanently remove anything. Every action it takes can be undone.
Start narrow. The first version shipped with a small set of actions we could test end to end. We added more only when we had evidence it was needed.
Tests are the acceptance. Nothing merged unless the suite was green. At launch that was 398 automated tests, and every pull request got its own preview deployment so changes could be checked in a real environment before release.
What is the architecture?
The AI gateway sits between the agent and the model provider, so the model can change without touching the product code.
What would we do differently?
Freeze before user testing. Early on, we pushed same-day changes into the live test environment while users were in it, and that was fragile. We now freeze a branch and stage it before every round of user tests. Small stacked pull requests keep velocity up without destabilizing the main branch.
What does this mean for your product?
If your AI feature only gives advice, the jump to an agent that acts is smaller than it looks. The hard part isn’t the model. It’s access control, reversibility and tests, and those are ordinary engineering decisions you can make up front.
See how we approach this in what production AI agent architecture actually looks like, or go straight to AI agent development. If you’d rather scope a specific feature first, start here.
Frequently Asked Questions
How did Chrono ship an AI agent to real users in under three weeks?
By keeping the first version narrow. The agent launched with a small set of actions that could be tested end to end, ran through the app’s existing data layer instead of a new one, and every change shipped behind a green test suite and a preview deployment.
How do you stop an AI agent from accessing data it shouldn’t?
Make it act as the signed-in user and send it through the same permission checks as the UI. On this platform, Postgres Row Level Security is the only access control for both, and no admin-level key exists that the agent could use to bypass it.
What happens if the agent makes a wrong change?
It can be undone. The agent can archive but never delete, so every action it takes is reversible by the creator.
