Bilingual travel assistance with deterministic safety rails.
A specialized bilingual AI assistant publicly deployed in production for Da Silva International / CAST Tours. Engineered to answer traveler questions using curated tour documentation, strictly isolate tour itineraries, filter sensitive customer information before external AI processing, and safely escalate unverified requests to human coordinators.
Publicly deployed production chatbot for Da Silva International / CAST Tours. Built with Python and FastAPI, powered by Groq inference, and evaluated across unit tests, regression suites, and 50 defined synthetic acceptance scenarios.
In guided tour operations, a fabricated meeting time, wrong baggage allowance, or invented refund rule creates real disruption.
CAST Tours operates specialized international concert and culture tours across multiple destinations. Each trip carries unique inclusions, concert ticket policies, luggage limits, and schedules. When travelers ask questions, standard generative chatbots introduce two unacceptable risks:
First, an unconstrained model can easily blend details across different trips—answering a question about one itinerary with policies belonging to another. Second, travelers often paste personal booking numbers, passenger names, or payment inquiries into chat inputs, which must never be forwarded to third-party AI endpoints.
Furthermore, CAST Tours serves a diverse bilingual traveler base in English and Spanish across desktop and mobile devices. The goal was to build an assistant that behaves like an experienced travel coordinator: answers must be grounded strictly in approved documentation, customer data must be screened deterministically before external calls, and whenever an answer cannot be verified with certainty, the system must hand off cleanly to human staff.
Real traveler interactions captured from the publicly launched WordPress chatbot widget.
The chatbot is deployed directly on the CAST Tours website as a responsive floating widget, supporting both desktop and mobile viewports. Every interaction adheres to strict architectural boundaries: single-itinerary scoping, bilingual Spanish and English comprehension, and deterministic safe referral whenever documentation lacks verified certainty.
CAST TOURS · STAFF REFERRAL. Unverified details escalate directly to human coordinators.
The architecture ensures external AI models never make policy decisions or access unscreened input. Deterministic Python services govern privacy screening, trip scoping, evidence retrieval, and output validation.
Production architecture of the live CAST Tours chatbot. Preflight filters screen personal and payment details before generation, and retrieval is constrained to approved tour documentation.
Private source repository: Source code, tour knowledge units, and production deployment configurations are maintained in a private repository for client confidentiality.
Customer questions pass through server-side regex screening before external AI generation endpoints are invoked. Booking numbers, payment terms, phone numbers, and email patterns trigger safe routing or sanitization, mitigating the risk of sensitive traveler details being transmitted to third-party APIs.
Travel inquiries are mapped to a single tour itinerary. The resolver matches questions exclusively to curated knowledge units for the active trip. Inquiries regarding retired or historical tour offerings are intercepted and referred to staff rather than generating speculative answers.
In public production, retrieved evidence is drawn directly from approved KnowledgeUnit documentation using deterministic lexical search. By indexing trip itineraries into discrete, verified units with bilingual Spanish and English keyword mapping, the system retrieves relevant clauses without introducing vector drift or semantic mismatch from third-party embedding models. Earlier offline development evaluated semantic embeddings for synthetic benchmarking, while the live release prioritizes verified lexical retrieval for predictable, auditable itinerary matching.
Production inference utilizes Groq acceleration to deliver sub-second response times without sacrificing deterministic schema conformance. Generation runs at temperature 0 constrained by strict Pydantic JSON schemas, ensuring that model outputs map claim strings directly to validated evidence IDs for server-side verification.
The backend runs automated rule-based checks on cited source IDs, scans for qualified wording, and deterministically escalates to human coordinators whenever an answer cannot be grounded in approved knowledge units—providing a structured safeguard rather than relying on model self-policing.
During the October 31 production deployment onto the client's live WordPress website, the floating widget was embedded inside an isolated iframe with a browser sandbox policy. While allow-scripts and allow-same-origin were enabled, the initial policy omitted allow-forms. Because message dispatch and Enter key submission in the widget rely on form submission semantics, the omission silently prevented visitors from submitting queries. I diagnosed the sandbox restriction, updated the embed configuration to include allow-forms, authored automated regression tests for embed security headers, and verified seamless production operation.
Because the assistant supports a real organization and public travelers, verification cannot rely on informal manual prompts. The system is continuously validated using comprehensive test suites.
Unit and integration test suites covering deterministic scoping, lexical retrieval, language detection, and error fallbacks across core backend services.
A structured suite of 50 synthetic acceptance scenarios designed to benchmark multi-turn privacy triggers, bilingual English/Spanish routing, boundary handling, and latency profiling without transmitting client data.
Automated tests verifying WordPress iframe embed configurations, ensuring sandbox security tokens (allow-scripts allow-same-origin allow-forms) are verified and prevent form-blocking regressions across mobile and desktop browsers.
Regression tests verify that retired or historical tour offerings (such as the October 2026 retirement of past tour catalogs) remain strictly excluded from active customer suggestions and responses.
Working directly with organization stakeholders and delivering a publicly deployed production tool showed me that knowing when not to answer is the most critical feature in practical enterprise AI.
Collaborating with leadership and staff at CAST Tours underscored that operational stakeholders care far more about reliability and predictability than model novelty. An answer that is 95% plausible but hallucinates a bus transfer time, ticket inclusion, or baggage surcharge destroys traveler trust immediately.
Taking the system from initial development to public production on WordPress required engineering rigor at every layer: from deterministic PII preflight screening and Groq low-latency inference to resolving real-world browser sandbox edge cases like the October 31 allow-forms fix. To support systematic evaluation, I built diagnostic timing middleware (cast_tours.timing) that records sub-millisecond durations across preflight filtering, lexical scoring, generation completion, and claim validation. This work reinforced how small, robust software foundations—clear interface contracts, strict schemas, automated regression tests, and defensive fallbacks—turn generative AI into a dependable business tool.
System architecture and technical engineering decisions can be discussed upon request.