A benefits web application: AI interprets input, code calculates. Scope, payments, access control and lessons from real failures.
The goal was to let a person describe their circumstances in ordinary language and receive an understandable overview of possible benefits. That required more than a chat window: input validation, rule-based calculations, explanations, payments and access control.
Implemented code covered intake, results, a paid personalised roadmap, a facility directory and an admin interface. Behind these sat a database, payment-event processing and reconciliation of access with payment status. Infrastructure existed for an encrypted document vault, but document upload was out of scope. The application does not file government applications or make an official eligibility determination.
The user writes about their circumstances. Free text is not yet a collection of verified facts.
AI converts the narrative into structured fields. Personal-data scrubbing and field validation check the input; these safeguards are not infallible.
The rules engine uses structured fields and defined rules. AI does not compute or alter monetary amounts.
Code recomputes headline amounts. Unclear or complex situations are routed to a person rather than filled with an invented number.
The user receives an explanation and, with the appropriate entitlement, a personalised roadmap. Payment handling and preservation of paid access are separate engineering tasks.
A broken staging API key silently activated a simple fallback extractor that did not understand negation. The fix separated development mock data from the real workflow and made extraction failure visible to the user.
The payment handler assumed incorrect field names, and cancellation could remove already-paid access. The fix used the actual event shape and retained access through the paid period.
At the source-review snapshot, a later fix remained unshipped and browser tests had not run in this check. Test results must be tied to a particular version and verification scope.
I directed product scope, sources and priorities, and decided what was ready to release. AI agents I directed split planning, implementation and review responsibilities. This was not an application completed in a single conversation.
AI extraction uses an external model service. Payment and encryption services also have their own data boundaries. Self-hosting does not mean all processing occurs on the same server.
This case is based on a review of project source and local checks on 11 September 2026, not an independent production audit. Examples are illustrative, not customer data.
Let us talk about how to build with AI while you keep control of the result.