Self-hosted AI infrastructure for internal automation
Glass-Box
AI Workflows
The opposite of building AI agents:
one AI agent that builds your team's automations for them.
one AI agent that builds your team's automations for them.
Vladimir Boldyrev
·
Open methodology
·
2026
01 / 14
Where this started
The same requests, week after week
Sales, ops, marketing. Everyone asks for the same kind of thing. Repeatable work that nobody owns.
Can you send me the list of clients with expiring packages this week?
Sales manager · weekly
Every morning, I want a list of yesterday's new dealers.
Sales lead · daily
Remind me in an hour to follow up on this deal.
Sales manager · ad-hoc
Weekly ARPU report by dealer tier, into this channel.
Country manager · weekly
The pattern: nothing fancy. Run a query, filter by a few rules, post the result to Slack or Notion, file a ticket, do it again on a schedule. The quotes here are from sales because that's where I started, but the same shape shows up in ops, marketing, and engineering. People do it by hand because nobody has time to build it.
02 / 14
Trigger
Why the popular AI shapes fall short
The shape of the agent decides everything
The work from the previous slide is recurring, autonomous, multi-user. The two AI shapes people reach for first don't fit it. For opposite reasons.
Claude Code · Codex · Cursor
Coding assistant
Runs
when you start it
Schedule
none · no cron, no events
Users
one · no team mode, no audit
Output
code you ship, agent doesn't run it
Classic autonomous agent
Black-box AI employee
Runs
on a prompt, then vanishes
Schedule
maybe, but opaque
Users
one chat, no replay, no audit
Output
actions you can't inspect
Glass-Box
Glass-box automation builder
Runs
on cron or events, no human in loop
Schedule
n8n workflow, visible, editable
Users
multi-user · RBAC · full audit
Output
workflow does the work, agent only builds
The shift: the agent doesn't do the work. It builds the thing that does the work. After that, the workflow is just an n8n artifact. Visible, editable, owned by the team. And the same toolbox is now exposed over MCP, so your own Claude Code or IDE can call it directly.
03 / 14
Reframe
What it is
One AI agent. Builds the automations your team asks for.
Self-hosted, runs in your Slack. Anyone on the team (sales, ops, marketing, support) describes what they need in plain words. The agent turns the request into a scheduled, runnable workflow. After the build, the workflow lives on its own. The agent steps aside.
Glass-Box
Direct message · also in #sales-ops, #product, #engineering
VB
Vladimir Boldyrev9:14 AM
Every Monday at 9, send me the list of clients whose packages expire that week.
G
Glass-BoxAPP9:14 AM
I'll set up a weekly digest. Quick confirm:
Deploy workflow: package-expiry
Schedule
0 9 * * 1 (every Mon, 09:00) · Destination DM @VB · Source your-crm.
Approve
Reject
G
Glass-BoxAPP9:14 AM
✅ Deployed. View in n8n · First run next Monday at 09:00 in your timezone.
04 / 14
Product
Who it's for, and what it unlocks
Use cases: real people, real value
Every card below is a real ask we've shipped or are about to. The point isn't the variety. It's that one clear agent covers all of these, and any developer on the team can maintain any of them in n8n.
Sales manager
Knowing which clients are about to churn, every morning
Cron workflow at 09:00 → packages expiring in 14 days → DM. Saves ~30 min/day, live in a 2-country production deployment.
Country lead
Weekly ARPU by tier without poking an analyst
Monday cron → ClickHouse query → country channel. No tab switching, no waiting.
Product / PM
Jira & Confluence without leaving Slack
Search by JQL, create a ticket with one-click confirmation, publish a page from markdown. No Atlassian tabs.
Operations
Reminders & recurring jobs the team can see
One-off (“ping me in 2h about X”) or recurring. Visible to the team, recoverable, editable.
Team lead
Onboard your own people without going through the COO
Delegated admin: grants in a team-admin scope. No COO bottleneck. Full audit.
Engineering
Ship a new capability for the whole team in one PR
1 JSON workflow + 1 markdown spec. No model retraining. No agent code change.
05 / 14
Use cases
How a request flows
One request, six layers
1
User
where the request comes in
Slack DM & channelsevents API
n8n UIopen & edit workflows
Claude Code · IDEMCP client
2
Orchestration
identity, safety, control
Agent runtimepersonality · plugins · MCP host
Guardrailstopic & safety rails
RBACrole · team · scope · delegation
Confirmationno write without ack
3
Agent
picks the right action
Intent routerHaiku · cheap classify
Template managermatch · parameterise
Data-queryscope-gated SQL
Digest formattercompose the reply
4
Tools
the real systems
n8n RESTcreate · update · activate
Read-only dataparameterized queries
AtlassianJira · Confluence
Slack APIDM · channels · files
MCP serverJWT · /mcp endpoint
5
Memory
what the agent knows
Personality filevoice & rules
workspace/memorymarkdown facts
Curated knowledgedistilled from Confluence
PostgresRBAC · grants · audit log
6
Foundation
where it runs
Claude Sonnet 4.6reasoning
Claude Haiku 4.5routing · 3× cheaper
Cloud VM4 vCPU · 16 GB · VPN-gated
Postgres · Redisstate · queues
NginxTLS · routing
06 / 14
Architecture
How the agent knows what it knows
Knowledge as markdown, not as a vector blob
No vector DB, no embeddings, no RAG. Wiki pages and team docs are distilled by hand into short, opinionated markdown files. The agent reads them like a teammate reads a wiki, and the file tells you exactly where the truth came from.
company
7 files
Data inventory, delegation, onboarding, Atlassian, templates catalog
sales
3 files
Client tier rules, lead-scoring playbooks, segment definitions
marketing
9 files
Google & Meta Ads, GTM, channel mapping
analytics
1 file
Mobile events catalog · ClickHouse + Firebase + PostHog
process
1 file
Curation framework: methodology for adding any new knowledge
How a Confluence page becomes knowledge the bot can use
Wiki page
Source of truth, raw & long
→
Distill by hand
1-3 paragraphs + 5-12 key facts
→
Bot reads the file
Via
knowledge-index & personality fileDenylist
No customer PII, no live credentials, no salary, no Confluence comments. Mixed pages → distill only the signal.
Freshness
Source page ≤ 6 months old →
current. Older → needs_review. Bot still uses it; human re-validates next pass.Refresh
No cron. Manual when source changes, or every 3 months for performance-critical files.
07 / 14
Knowledge
What it can do today
Six capabilities, all visible in n8n
Ask the data in plain words
Safe SQL against the read-only replica. RBAC gates tables and columns.
Schedule a digest
“Every Monday at 9, send me X.” → n8n cron workflow → DM or channel.
React to events
New deal, expiring package, new lead. n8n watches, the agent formats and delivers.
External tickets and docs
Search/create Jira, publish Confluence. Every write gated by a confirmation step.
Delegated administration
Team leads onboard their own people, scoped to their team. COO floor: can't remove the last admin.
Permissions & audit
RBAC (role × team × scope × delegation). Every grant in the audit log. Identity can't be faked.
08 / 14
Capabilities
Power-user surface · opt-in
Open the same toolbox from your own Claude Code
The Slack agent is one face. The toolbox behind it is exposed as an MCP server at
https://your-instance.example.com/mcp/. Same RBAC, same audit, no parallel store.
What happens when your Claude Code calls a Glass-Box tool
Identity comes from JWT
sub claim, never from a tool parameter
Claude Code
Calls
agent_* tool with Bearer JWT in HTTPS POST→
/mcp endpoint
TLS-gated route to the runtime container
→
JWT & revocation
verify signature + check revocation list
→
RBAC dispatch
verify identity, scope-gate, route to tool
→
Tool exec + audit
audit row before mutation · result back to client
How you get in
Two slash commands, self-service
/request_mcp_access → Owner approves → /mcp-token issues a 24h JWT. Paste into Claude Code mcp.json. Done.
What you can call
Four tool categories, all
Four tool categories, all agent_*
Read-only data (14 templates · 5 sources) · knowledge files · n8n CRUD · Jira & Confluence read & write. The full surface, not a subset.
Safety net
Audit + revocation
Every call → the audit log. Mutations: audit row goes first. A leaked laptop is revoked with one Slack command.
09 / 14
MCP
Roles and access · the architecture
One Owner. Teams in the middle. Team Owners and Managers inside each team.
OWNER
root of trust
- Adds people to teams
- Promotes the first Team Owner of a team
- Full data and tool access
↓
creates teams · promotes the first Team Owner
team: sales · marketing · …
assigned explicitly by the Owner
TEAM OWNER
- Onboards new Managers in their team
- Promotes Managers to Team Owners inside the team
- Grants access in team scope
- Cannot touch the Owner role
MANAGER
- Uses the bot in their team
- Asks data, builds digests, files tickets
- Bounded by the team
team: company
auto-assigned
every user gets it on first DM
The baseline scope. Everyone is in
company by default. It unlocks the universal tools that work for any role. No Team Owner needed.
Trust boundary the LLM never passes
slack_id
Confirmation every write waits for explicit approval
Audit every grant logged in the audit trail
tool_scope opt-in flags like mcp-access gate special surfaces
10 / 14
RBAC
The glass box: what actually gets deployed
Every automation the agent ships is a workflow you can open in n8n
Open it. See the trigger, the SQL, the schedule, the destination. Edit anything. Re-deploy. The agent is no longer in the loop. The workflow is yours.
n8n · daily-digest · active
⏱
Schedule
04:00 UTC weekdays
04:00 UTC weekdays
DB
Query users
scoped read-only
scoped read-only
⇆
Split batches
chunked
chunked
@
Search tickets
assigned · open
assigned · open
{ }
Format payload
compose digest
compose digest
↗
Send to Slack
DM destination
DM destination
▤
Log run
audit row
audit row
8 production-ready workflow templates today. Reports and digests, triggered alerts, ticketing, custom cron, infra. Adding a new one is one JSON file plus a short Markdown spec. No change to the agent code.
Want to open the editor yourself? Ask the bot for n8n access in Slack. The bot pings an Owner for approval; on Approve, you get the credentials in DM.
11 / 14
Glass box
Cost: pay to build, not to run
About $5 to $10 to build a workflow. Then $0 to run it for a year.
The agent's job is to build automations. It's not your daily chat assistant. For that, everyone already has a Claude subscription. The token spend happens during the build conversation. After that, the workflow runs on its own and burns nothing.
$5–10
Claude tokens per workflow build
$0
per scheduled run, forever
$0
per new template, per new user
Cost per workflow · year 1 of running it
scale: $0 ← → $1,200 / workflow
Glass-Box workflowbuild once · run on cron · no LLM per run
$5–10 build · $0 to run, forever
~$10one-time, all in
SaaS automation toolZapier · Make · etc · per-user-per-month
$20–100 / user / month · forever
~$1,200/ user / year
At a real-world scale: 100 workflows in production cost ~$500–1,000 one time, then close to $0/month to run. MCP usage adds $0 because those tokens burn on your own Claude subscription. The only fixed cost is the cloud VM. No per-seat fees, no managed agent platform, no vector DB.
12 / 14
Cost
Want it in your team?
One install. One AI agent. Every automation your team asks for.
Three free installations to start. After that, a single fixed-price package: setup on your infrastructure, configured workflows, and training for your operators.
13 / 14
CTA
That'stheendofmypresentation
ThankYouforwatching
14 / 14