(04) ProjectAI-native project management

FlowAI

A Linear-style task manager with an AI agent that carries out real operations from plain language, under exactly the same permissions the user has in the UI.

Role
Full-stack developer
Context
AI-native project management
Stack
Next.js 16, React 19, TypeScript, MongoDB, Better Auth, Vercel AI SDK
(01)Overview

Overview

FlowAI is an AI-native project manager in the style of Linear. An embedded agent carries out real operations from natural language, like “move the dashboard task to In Progress and assign it to Rahul”.

The agent works under exactly the same permissions the user has in the UI, so it can never do more than the person asking.

(02)Workspaces & access

Workspaces & access

  1. 01

    Multi-tenant workspaces

    Create a workspace or join any number by invite, with a workspace switcher, onboarding and live name and slug availability checks.

  2. 02

    Five roles

    Access is enforced on the server for every operation, down to per-field rules: a member can only change the status of a task assigned to them.

  3. 03

    Invitations

    Invite by email or with expiring single-use share links, with copy, revoke and role scoping.

(03)Tasks & projects

Tasks & projects

  1. 01

    Views

    Kanban and table views with drag and drop.

  2. 02

    Task details

    Priorities, assignees, due dates, tags and comments.

  3. 03

    Autosave

    Descriptions save as you type, with optimistic updates across the app.

(04)AI agent

AI agent

  1. 01

    13 tools

    Every tool is gated by the permissions of the person asking.

  2. 02

    Multi-step loops

    The agent chains tool calls to finish a request, streaming its reasoning and tool calls over SSE.

  3. 03

    Two models

    Switch between Mistral and Gemini.

(05)Security

Security

  1. 01

    Tenant isolation

    Found and closed a cross-tenant NoSQL operator injection.

  2. 02

    Validation

    Zod validation at every trust boundary.

  3. 03

    Rate limiting

    Limits on the auth and AI routes.

  4. 04

    Prompt-injection guardrails

    The agent can never act beyond the caller's own rights.

  5. 05

    Tests

    A test suite for permissions and injection attempts.

(06)Performance & polish

Performance & polish

  1. 01

    Fast paths

    Request-level memoization, cached session cookies and indexes on the hot queries.

  2. 02

    Interface

    Dark and light themes, responsive layouts, and loading and error states.