Envoy.

Embassy staff spend roughly one week per month managing the inflow of diplomatic event invitations across fragmented channels. Invitations arrive at the official embassy email, the ambassador's inbox, the minister's inbox, individual staff addresses. There is no single source of truth.

The work itself is dense. Invitations arrive in multiple languages. Event details live inside PDF attachments behind login portals. Coordination cascades into follow-up correspondence about logistics, RSVPs, and changes. Ownership ambiguities lead to dropped balls. Institutional memory walks out when staff rotate.

The administrative coordinator we shadowed had built her own system: a 13-column spreadsheet that she maintained by hand. It was the best workaround possible for an organization that did not have a tool designed for the job.

Discovery happened across about three hours of recorded conversations: one session with the ambassador and two with the embassy's administrative coordinator who manages invitations and stakeholder routing day to day. The transcripts were turned into a multi-day pass on the spec, building out the data model against the actual workflow described. Research into the Vienna Convention, data sovereignty requirements, and diplomatic protocol became part of the architecture decisions.

The discovery process produced a key insight: confidential diplomatic communications never leave the country. Only public invitations are processed further. This single principle drove every subsequent architectural choice.

The hard part of this system was data sovereignty. The Vienna Convention requires that diplomatic communications stay inside the country where they were received. GDPR layers separate constraints on European traffic. Both had to be enforced architecturally, not patched on later. Most of the engineering complexity lived in routing computation across regions to comply with these constraints.

Per-country sovereign deployment

Email classification runs inside the country where the emails arrived (e.g., a service in Mexico City handling Mexico's traffic). A country's emails never leave its borders. Only sanitized, structured metadata returns to a central index.

Per-region LLM provider routing

EU-bound traffic runs on Mistral and EU-hosted inference endpoints to maintain GDPR compliance. Other regions use providers appropriate for their jurisdiction. Provider choice is configuration, not code.

Multi-tenancy on two levels

Per-country database isolation for legal residency, plus per-embassy row-level security inside each country's instance. A single deployment serves any country's compliance requirements through config.

Adapter pattern

Three email providers (Gmail OAuth, Outlook OAuth, Resend), three LLM providers (OpenAI, Gemini, Mistral), unified behind clean interfaces. Adding a new region or a new provider is configuration, not code.

Inngest orchestration

Email sync runs as managed workflows with retries, fan-out, replay, and monitoring. Failures that would break a fragile cron job are handled by the platform.

Event series memory

Embassies attend recurring events year after year. The system links new invitations to historical event series automatically, surfacing prior context to staff. Institutional memory survives staff rotation.

Before a system like this can touch real diplomatic correspondence, the classification has to be measurably accurate. We built a comprehensive evaluation set: real seed emails from the engagement, expanded into 100+ permutations covering edge cases such as multilingual content, ambiguous routing, malformed PDFs, forwarded chains, and partial information.

The system reached 98% classification accuracy on this evaluation set. The architecture, the prompt engineering, and the routing logic were all stress-tested before any go-live conversation.