AI Copilot is the seventh CleverInit module — and the platform's first AI-native surface. Install it on your tenant and your admins can talk to the platform in plain English, Dutch, or German. Create draft invoices. Find customers who haven't paid. Summarize a week of chat. Diagnose why a subscription went past-due. The Copilot does it by calling the exact same Commands and Queries your engineers wrote — never by guessing, never by hallucinating, always with full audit trail.
What makes it different: it is not ChatGPT in an iframe. The LLM is the orchestration brain; CleverInit's CQRS handlers are the hands. Every consequential answer is backed by a tool invocation whose inputs, outputs, latency, and cost are recorded. Every mutating action requires explicit user confirmation. Per-tenant cost caps prevent runaway loops. Per-tenant provider selection (OpenAI, Anthropic, Azure OpenAI, Mistral, Ollama) gives you the EU sovereignty story your customers will ask about on the first compliance call.
A tenant admin types "Create a draft invoice for Acme Holdings for €5,000 due in 14 days". The Copilot picks the Invoicing tool pack. Permissions check runs. FluentValidation runs. The same MediatR pipeline your engineers use runs. A draft invoice appears in the panel with Acme pre-linked. The admin clicks "Issue". Done. No new endpoints. No custom integration. Every module on your tenant just became conversational the moment Copilot read its tool pack.
Every Copilot answer is grounded in a tool call — a typed Command or Query that already exists in your platform. The LLM picks the right one; your CQRS handlers do the work.
Most AI products bolt an LLM onto a REST monolith and let the model guess the endpoints. CleverInit is different: every state change is already a Command, every read is already a Query. The Copilot just calls them.
You type or speak. Dutch, English, German — auto-detected. Voice is delivered via the same SignalR hub your chat module uses.
From a registry every installed module contributes to. Each tool has a typed input schema, a typed output, a required permission, and a scope.
Your effective permissions are evaluated before the model sees the tool. FluentValidation runs on the input. Defense-in-depth, identical to your hand-written endpoints.
Same pipeline as every other Command — Logging, Validation, Cache Invalidation, Transaction. The Copilot adds nothing custom; it reuses the platform you already trust.
Result hash, cost, latency, redacted args go to an append-only audit table. The answer streams back to you token-by-token, with tool-call status updates.
A Dutch healthcare tenant under GDPR can pick Mistral or Ollama hosted in the EU. A US fintech can pick OpenAI or Anthropic. Credentials are encrypted via Data Protection — same pattern as Stripe and Mollie keys today.
Most capable general model family. Familiar tool-use envelope. The default choice for tenants who already standardize on OpenAI.
Strongest performance on long-context, multi-step tool chains. EU-region inference now widely available. Recommended default for new tenants.
Same wire protocol as OpenAI behind an Azure-managed endpoint. The right answer for tenants who already sign EU data-residency agreements with Microsoft.
Headquartered and operated in the EU. The sovereignty answer for healthcare, government, and fintech tenants whose compliance team will ask the question.
Tenant-hosted on-prem inference. No external network egress. Lowest cost, highest privacy posture. Configure once per tenant; the rest is identical.
Each CleverInit module exposes its Commands and Queries as a tool pack. Install the module — its tools light up in Copilot. Uninstall it — they disappear. No new endpoints, no custom integration, no model retraining.
Software houses and ISVs building modules on top of CleverInit get the biggest win. Implement the ICopilotToolProvider contract in your module's Contracts package, declare your tools, and every tenant who installs both your module and AI Copilot can drive your features by voice or text. No language model expertise required. No prompt engineering. The LLM handles the language; your CQRS handlers do the work.
The Copilot ships with the strictest defaults that still feel useful. Tenants can loosen each one — but the defaults are designed to survive a CISO review without changes.
Every tool is gated by a [HasPermission] string on both the controller boundary and the handler. A user without the permission cannot even see the tool in the model's request envelope.
Mutating tools (draft, issue, send, post) require an explicit click before they run. Read-only tools execute inline. Auto-execute for safe reads is gated by a per-user permission, opt-in.
v1 explicitly forbids the Copilot from initiating charges, refunds, mandate creations, password resets, role changes, or user creations. Read-only at most for the regulated surfaces.
Every API key is encrypted at rest via IDataProtectionService — the same pattern used for Stripe, Mollie, and PayPal keys today. Plaintext is held only inside a request scope, decrypted at the call site, never logged.
Per-tenant daily and monthly caps, per-user daily caps. Breaches publish CopilotCostLimitBreachedV1 and suspend the session with a clear message. A runaway loop is bounded in cost, not in apology.
Sessions can be archived (default) or hard-deleted. Hard delete is gated by a separate AiCopilot.Erase permission — because not every operator should be allowed to destroy audit evidence, even their own.
Install AI Copilot from your marketplace, point it at a provider (OpenAI, Anthropic, Azure, Mistral, or your own Ollama), and your tenant admins can drive every installed module in plain language by this afternoon.
Tell us where you want to take your business. We'll show you the fastest path to get there — whether you want a fully managed platform, a custom module built exclusively for your tenant, or a fully branded product to sell to your own clients.