Asis — Secure WhatsApp AI Operations Assistant

Inspiration

What it does

How we built it

Challenges we ran into

Accomplishments that we're proud of

What we learned

What's next for Asis — Secure WhatsApp AI Operations Assistant

Inspiration

Small businesses often need operational answers while they are away from a desktop, but the fastest channel—WhatsApp—becomes risky when identity, duplicate delivery, provider failures, and AI routing are treated as afterthoughts. Asis makes WhatsApp a secure operations interface while keeping sensitive boundaries explicit and testable.

What it does

Asis ingests Azure Communication Services events through separate ingestion, routing, policy, and application-service layers. Provider adapters normalize Cosmos DB, WhatsApp, Azure OpenAI, Google Places, and email behavior. A server-generated WhatsApp OTP flow binds consent, challenge, browser session, throttling, expiry, and a Secure HttpOnly session without persisting plaintext OTPs.

How we built it

The public judging package is a credential-free, runnable extraction of the production architecture. It includes sanitized sample events, injected fake providers, focused contract tests, and a demo that exercises the layered webhook plus OTP flow. OpenAI routing uses an explicit general-versus-advanced policy and fails closed when a required deployment is unavailable.

GPT-5.6 through Codex accelerated the cross-repository work: Codex reconciled the Website, Asis runtime, and Control Tower into a versioned integration contract; decomposed the webhook; implemented and tested server-side OTP security; built provider adapters; inspected CI; and preserved exact release evidence. Key decisions were captured in code, tests, documentation, and protected GitHub workflows rather than left as chat-only conclusions.

Challenges

The hardest parts were preventing duplicate events from duplicating side effects, keeping raw phone/OTP/session data out of storage and evidence, normalizing five providers without leaking provider mechanics into business logic, and deploying across two Azure tenants with least-privilege OIDC boundaries.

Accomplishments

• Layered, independently testable webhook architecture
• Hashed, expiring, rate-limited WhatsApp OTP with session binding
• Idempotent inbound-event claims
• Five normalized provider adapters
• Explicit GPT-5.6/OpenAI routing policy
• Public MIT judging repository with green CI and no cloud credentials required

What we learned

AI-assisted engineering is strongest when the agent can connect architecture, code, tests, security controls, deployment evidence, and rollback constraints. Codex shortened that loop while the versioned contracts and CI kept every decision auditable.

What's next

Expand production observability, add more multilingual operational workflows, and measure how the advanced routing policy improves resolution quality and operator time.

Built With

• azure-communication-services
• azure-openai
• codex
• cosmos-db
• github-actions
• gpt-5.6
• javascript
• node.js
• oidc
• security
• whatsapp