Derin İlkcan Karakoç

[Derin İlkcan Karakoç @kahveciderin]

launching something, here we go again
#buildinpublic

https://t.co/ESz7nXcGzE

[Derin İlkcan Karakoç @kahveciderin]

@jonathan_wilke its always dns

[Derin İlkcan Karakoç @kahveciderin]

oberik is the agent layer you drop into your SaaS. instead of building RAG, sandboxes, queues, multitenant isolation for your agent (and more), oberik lets you ship the whole thing this afternoon

concrete version: your user types "clean this export and chart revenue by region" into your product. the agent pulls their file into a linux sandbox, writes and runs the python, and hands a PNG back over the same stream that carries the tokens. ask it a question instead and you get the answer with the document, page and quote it came from. someone at another customer can't touch any of it, every project is its own tenant. you can even let it reason on your customer's data that's already in your platform

two calls to integrate: your backend mints a token scoped to one end-user, your frontend streams

[Derin İlkcan Karakoç @kahveciderin]

launching something, here we go again
#buildinpublic

https://t.co/ESz7nXcGzE

[Derin İlkcan Karakoç @kahveciderin]

@evisdrenova we built https://t.co/ESz7nXcGzE for this reason - 1 API to run an agent

[Derin İlkcan Karakoç @kahveciderin]

agreed, and the version that actually holds is keeping the credentials yours rather than the vendor's. a harness that resells you tokens has an incentive to keep you on whatever it marks up best. provider mixture only hedges anything if switching is a config change rather than a migration

[Derin İlkcan Karakoç @kahveciderin]

worth separating that list into two piles, because they have very different economics

change management, vertical UX and domain evals are irreducible. they are the actual moat and every applied AI company has to earn them itself

the harness, the model routing, the tenant isolation, the citation plumbing: identical for every one of these companies and rebuilt from scratch by all of them. that half is infrastructure pretending to be strategy

[Derin İlkcan Karakoç @kahveciderin]

the list at the end is the interesting part: Salesforce, Box, Harvey, ServiceNow. all of them built the deterministic layer themselves because at that size you can

the vertical SaaS company serving 400 dental practices wants the identical thing. per customer isolation, permissions the agent cannot argue past, an answer traceable to a document. they just cannot spend six quarters building it before shipping anything

that gap is where most of the agent deployments over the next two years actually have to come from, and almost nobody is building for it

[Derin İlkcan Karakoç @kahveciderin]

@daltonc this is exactly the reason we built an ssh gateway for https://t.co/ESz7nXcGzE
everything the agent needs to configure the project is available to it over ssh, no installation required
also my claude loves to pipe the outputs to jq to quickly find what it needs

[Derin İlkcan Karakoç @kahveciderin]

@yoimnotkesku attention squared is all you need

[Derin İlkcan Karakoç @kahveciderin]

the beliefs with the longest half life are the boring ones, and they are all about the plumbing rather than the model

"answers need sources", "one customer's data must not reach another", "you need to know what a request cost". nobody has ever cycled on those. they were true for search, they were true for analytics, and they are true now.

the six month churn is almost entirely on questions about the models. the questions about the product around them have barely moved

[Derin İlkcan Karakoç @kahveciderin]

the admin app for agencies is where this gets interesting and also where it gets hard

once an agency runs twenty creators, the questions stop being "show me this deal" and become "which of my deals renew before March" and "which ones have exclusivity clauses that conflict". that is a search problem over everyone's contracts at once, scoped so agency A never sees agency B, worth designing the isolation in now rather than after the first agency asks

[Derin İlkcan Karakoç @kahveciderin]

the fix that scales better than a human check is making the agent unable to return a contact it cannot attribute to a source. no source, no row. you lose some recall and you stop shipping phantoms entirely

human review catches it after the model has already decided. the constraint catches it before, we build that as a hard rule rather than a prompt

[Derin İlkcan Karakoç @kahveciderin]

the failure path is the system. everything else is a demo with a nicer font

the three that always get skipped: what happens when retrieval returns nothing, what happens when a tool call is refused, and what happens when the job that was supposed to run at 3am did not

none of them are model problems, which is why they never show up in the eval suite

[Derin İlkcan Karakoç @kahveciderin]

"just OCR it and send it to an LLM" is the trap almost everyone walks into once

scanned bank statements are the worst case because the table is visual, not structural. what worked for us was layout aware parsing first, OCR only on the pages that actually need it, and then refusing to answer at all when a number cannot be tied back to a cell on a page

the refusal is the part that makes clients trust it. a wrong figure in a bank statement costs more than a missing one

[Derin İlkcan Karakoç @kahveciderin]

@anupamrjp https://t.co/ESz7nXcGzE

we're actually using it for most of our internal projects nowadays

[Derin İlkcan Karakoç @kahveciderin]

property managers are a good second act, and the documents are the real moat there. leases, invoices, notices, all sitting in folders nobody can query

whoever first lets a manager ask "which leases renew before March" and answers with the clause and the page wins that segment well before the payments piece matters (we do that part as infrastructure, https://t.co/rBu0KfKjpM, free while we launch)

[Derin İlkcan Karakoç @kahveciderin]

respect for publishing the list instead of selling into all six

law firms are the interesting one. it is usually not that the model cannot help, it is that you cannot prove the answer came from that client's file and nobody else's. once grounding and per client isolation are enforced rather than prompted, a chunk of that category opens back up

we had to build that layer multiple times for different products, so much so that it became its own product

[Derin İlkcan Karakoç @kahveciderin]

the tools are not really the problem, the context boundary is. hubspot knows the deal, xero knows the money, clickup knows the work, and nothing holds all three at once.

the version that works is an agent that reads across all of them for one customer at a time and tells you which system each number came from. without that last part nobody trusts the number enough to act on it.

[Derin İlkcan Karakoç @kahveciderin]

the wrong answer screen IS the product

the only thing that really moved it for us was making groundedness a hard rule instead of a prompt. if a claim cannot be tied to a source, it does not reach the user at all.

that turns "it hallucinated" into "it said it did not know", which people forgive

[Derin İlkcan Karakoç @kahveciderin]

the moment a second customer exists, honestly

the trap is that a flat memory blob works fine in the demo and keeps working right up until one customer's data shows up in another's answer. at that point it is an incident, not a bug.

agree on the separation. the piece people skip is that authorization has to still hold when the model calls a tool, not just on retrieval

[Derin İlkcan Karakoç @kahveciderin]

when the answer stops being generic.
an internal agent can be sloppy because you already know its blind spots. a customer facing one has to be scoped to one customer's data, cite what it says, and refuse when it cannot.
the test we use: could you hand it to two competitors on the same instance without either seeing the other's rows. if not, it is still internal.