Sarah is a single AI persona -- in Slack, on the phone, in Zoom -- that answers questions and takes action across the business: call-center stats, client appointments, ticket filing, email triage, scheduling. Not a chatbot: a governed, audited, tenant-scoped operator where who you are decides what she can reach.
One orchestrator holds a menu of small, single-purpose workers and routes to one through the guarded door -- never a pile of 50 tools it runs itself. A new capability is a new worker, never a wider brain.
Read-only VICIdial: call stats, dispositions, agent status, lists, DIDs, hopper depth.
Storm client lookups: appointments, packages, balance, disputes, QC, ZIP coverage.
File a bug / feature / support ticket on your behalf -- one-turn, no interrogation.
Company policy, SOP, onboarding + scheduling knowledge, scoped to you.
Look up / create / edit Google Calendar events (writes are approval-gated).
Draft an email or text -- records only, never sends without approval.
Add or remove a number from the VICIdial Do-Not-Call list.
Your commission: per-deal lines, chargebacks, bonuses; managers see their reps.
Your onboarding + contract-signing status, next step, dated timeline.
Your training: enrollments, progress, overdue courses, cert expirations.
Your latest pay-period summary, history + line items.
When she can't do it: tag a human and file the ticket so nothing drops.
What you're allowed to see comes from who you are and where you're standing -- not anything you or the model can type. Scope arguments are overwritten server-side, spread in last, so the AI's version can never loosen them.
Storm clients share one campaign, so each is routed to their own client-scoped data and can never reach a dialer query -- seeing that would mean seeing every sibling client. The track decides the data source and the worker allowlist.
If memory is slow she degrades and keeps answering (fail-open on latency). If she can't prove which tenant you are, she refuses rather than fetch everything (fail-closed on scope).
Every routing decision and every action emits one audit row through one shared emitter -- mutations on a tamper-evident sha256 hash chain with an undo hint. No console-log trail, no second store.
The orchestrator can only reach a worker that's actually registered; an unknown one becomes an honest refusal. A coded-but-never-called component is treated as a defect.
The new brain runs dark beside the live one -- same real scope, zero tokens, never posting -- then promotes traffic 5 / 25 / 50 / 100% on a deterministic per-conversation hash. The serve switch stays human-gated.
Every turn is logged to a single Postgres + pgvector store -- episodic recall plus a semantic layer that collapses near-duplicates nightly, and degrades to plain timestamp recall if the vector index is ever missing. One store, never a second that can drift out of sync.
Sarah is the front door to the whole platform -- she files the tickets Fabrica builds, and stands beside the apps the forge shipped.