Guardian

Voice-first grocery and pharmacy for elderly parents, with family-approved spending and a two-layer scam shield.

Comment

Inspiration

Grocery delivery apps and pharmacy portals weren't built for the people who need help the most. Our grandparents can comfortably make a phone call, but downloading an app, remembering a password, tapping through a cart, and entering a card number is a wall. At the same time, elder fraud is a $3B+ problem — gift-card scams, fake IRS calls, "grandchild in trouble" schemes — and the current defense is "please be careful." We wanted a service where the senior keeps the one interface they already trust (a phone call), the family keeps oversight through a one-tap SMS, and a hard safety floor sits in front of both.

What it does

Guardian is a voice-first grocery and pharmacy service for elderly parents.

  • The senior calls or texts a familiar number — no app, no login, no cart UI.
  • An AI agent takes their list, matches it against their usual items, builds a cart, and runs it through a deterministic Scam Shield + risk score.

one-tap SMS, and a hard safety floor sits in front of both.

What it does

Guardian is a voice-first grocery and pharmacy service for elderly parents.

  • The senior calls or texts a familiar number — no app, no login, no cart UI.
  • An AI agent takes their list, matches it against their usual items, builds a cart, and runs it through a deterministic Scam Shield + risk score.
  • Anything unusual (new item, over the daily spending cap, high risk) is sent to the adult child as a one-tap SMS approval.
  • Payment runs on a sandboxed Visa agent card. The senior gets a plain-language status update over iMessage with an audio version read back in a familiar voice.
  • The family dashboard shows the latest request, pending reviews, recent activity, spending caps, scam-shield blocks, and a prescription refill follow-up panel that flags any medication with zero refills remaining so the family can call the prescribing office.

The scam shield runs before the LLM. Even if the agent layer fails, the senior cannot be tricked into spending money without the family seeing it first.

How we built it

  • CREAO orchestrates four agents — Purchaser, Scam Shield, Status Updater, Voice Reader — each with its own app-scoped API key (full details below).
  • ElevenLabs powers the senior-facing voice agent plus an audio companion for every text update, so grandma can hear what she can't read fast.
  • Photon is the iMessage transport — one shared line for all of Guardian's threads, with approvals and status updates landing right in the senior's phone.
  • Visa agent card integration is scaffolded as a sandbox-ready stub (currently a labeled mock so the dashboard can show the full workflow without real card movement); a GUARDIAN_LIVE_RETAILER flag keeps all senior-facing copy honest.
  • Instacart Developer Platform turns the agent's cart into an intent-to-cart link.
  • Next.js 15 App Router as a single app for the backend (tool API + webhooks) and the family dashboard, with Neon Postgres + Drizzle underneath.
  • Paper for the whole design direction (full details below), implemented with help from the 21st.dev MCP server for component scaffolding.
  • Vercel for hosting + preview deploys, GitHub Actions cron hitting /api/cron/scheduler every 5 minutes, Sentry for tracing and agent monitoring.

The decision pipeline is deterministic by design: freeze → scam → high-risk → over-cap → usual-items-auto-approve. The LLM is the subordinate layer; the rules still catch gift-card scams if CREAO is down.

Built on CREAO

Guardian orchestrates four CREAO agents, each with its own app-scoped API key, called from lib/providers/creao.ts:

Sample end-to-end run (Purchaser, 19 steps, terminal stage paid):

https://agent.creao.ai/chat?threadId=12bbca21-7e25-420c-a96a-3382d27c87a7

ElevenLabs — Voice everywhere Grandma touches

Two uses:

  1. Live voice agent — Grandma calls one phone number and talks to an ElevenLabs agent (SIP routed through Photon). The agent runs the Guardian tool API defined in tools.schema.json (10 tools: scam check, cart build, approval, payment, status). Config lives in the ElevenLabs dashboard; the post-call webhook lands at app/api/elevenlabs/webhook/route.ts.

  2. TTS for status updates — Every iMessage Guardian sends Grandma is followed by an MP3 attachment generated by eleven_turbo_v2_5 via lib/providers/elevenlabs.ts, so she can hear it if she can't read fast. Delivered through Photon as a playable audio attachment (the Beta shared line rejects type: "voice", so we send as MP3).

Photon — iMessage transport

  • Shared iMessage line (Beta) — One number for all of Guardian's threads. Grandma opens the thread by texting the line first (Beta rule: shared lines can't send first).
  • Spaces, not phone numbers — Sends target pho_spc_... IDs, pinned in PHOTON_SPACE_ID. See scripts/photon-ids.ts to resolve them.
  • Idempotency + dedup — Every send carries an idempotency key (to + body hash + ms), and status_update collapses repeats within 10 seconds.
  • Audio attachments — Every outbound text is paired with an ElevenLabs MP3 of the same copy, so Grandma gets both to read and hear.
  • Isolation — Only Grandma has a seat on the shared line; sends to any other number are logged and skipped so Elena's messages can never land in Grandma's thread.
  • Inbound — app/api/photon/webhook/route.ts turns iMessage replies into CREAO Scam Shield + approval events.

Visa — Agent card

lib/providers/visa.ts is currently labeled mock and returns a simulated payment reference.

The dashboard can demonstrate the payment workflow without a real card movement. Connecting the checkout flow to a real Visa sandbox agent card remains a future integration step.

Designed in Paper

Guardian's visual language was built end-to-end in Paper — an editorial direction anchored on DM Serif Display + Inter over a warm ivory ground (#FAF8F6), with a single violet accent (#7770A8) and peach + sage support tints. The design tokens from the Paper file translated 1-to-1 into the shipped CSS modules.

9 artboards explored, 5 shipped to production:

  • Homepage (1440×2606) → live at /
  • Editorial Family Dashboard — Desktop (1440×1952) → live at /dashboard
  • Editorial Family Dashboard — Mobile (390×3759) → responsive /dashboard
  • Feature Map Sketch (1000×900) → the circular agent map on the landing page
  • Safety Review (1440×900) → the approval detail at /approvals/[id]

Still-in-exploration (in the file but not shipped): a Senior Mobile view and a Caregiver Sign-in screen.

File (view-only): https://app.paper.design/file/01M574NZA2W9BT6TCGNYQ0YDZK/p-1-0

Challenges we ran into

  • Multi-agent handoffs are messy. Getting the Purchaser → Scam Shield → Status Updater → Voice Reader chain to pass state cleanly (and recover when one agent misbehaves) took real iteration on the tool schema.
  • Keeping the LLM subordinate to the rules. It's tempting to let the agent "decide" what counts as safe. We ended up moving all pass/fail logic into deterministic services, so the LLM's output is advisory, not authoritative.
  • Senior-facing honesty. Status copy had to stop telling Grandma "arrives Thursday" when nothing actually ships in demo mode. We added a GUARDIAN_LIVE_RETAILER flag that appends [demo — not a real delivery] until a real retailer is wired up.
  • Redesigning the dashboard mid-flight. The old approvals page was unstyled dark Markdown. We rebuilt it inside the family workspace layout and gave the prescription panel an actual purpose (renewal follow-up) instead of just dumping a list.

Accomplishments that we're proud of

  • A scam shield that runs before the LLM — the deterministic layer blocks gift-card and IRS patterns even if every agent is offline.
  • A phone-first UX that genuinely requires zero app installs on the senior side.
  • A family dashboard that reads like a quiet, warm newspaper instead of a SaaS admin panel — animated review states, workflow stepper, scam-shield tally, and a renewal follow-up panel that respects what the system can and can't actually do.
  • A voice loop: every status text to the senior is paired with an audio version in a familiar voice, stored and replayable.
  • Four CREAO agents live and wired, with HMAC-verified webhooks and app-scoped keys so a single leaked key can't impersonate the whole system.

What we learned

  • Elder-care software is a product discipline, not just an accessibility checklist. Every copy decision matters — "Approved" vs "Approved by family" changes trust.
  • AI agents should sit inside deterministic rails, not drive them. The rails are the safety; the agent is the convenience.
  • Preview deploys + a real color palette early catch 10× more bugs than Lighthouse ever will.
  • "No app" is a feature, not a limitation. It forces every interaction into channels the user already trusts.

What's next for Guardian

  • Wire a real retailer behind GUARDIAN_LIVE_RETAILER so orders actually ship.
  • A refill request flow that completes end-to-end with the pharmacy (currently families still make the renewal call).
  • Multi-approver households (two adult children, co-approval rules).
  • Caregiver-grade audit log export (PDF monthly summary for family meetings or power-of-attorney records).
  • A Spanish-language voice and copy pass — the demographic is bigger than the English-only MVP implies.

Built With

Share this project:

Updates

Submission history