I designed and built the anxiety bot "Ministry of Existential Safety" end to end — the product, the architecture, and the code, in AI-native mode. The decisive move wasn't "wrap a model around everything." It was drawing a boundary: where a model is free to improvise, and where it is forbidden to touch the output. The model writes only the satirical relief. The therapy and the crisis handling run on deterministic code with no model call at all — because there a wrong word costs not a weaker joke but a person in distress.
This is what I do as a fractional AI consultant: I decide where a model belongs and where it's a liability — and I enforce that line in code, not in a prompt.
The AI boundary — is the architectural decision about where a model may produce the output and where it may not. Here the model writes only the satirical relief; the therapy, the grounding, and the crisis handling are deterministic and contain no model call. The boundary is enforced in code, not left to a prompt.
What is the bot, and why is the boundary the whole point?
The bot takes a person from a spike of anxiety to a concrete next step. It has two parts, and the difference between them is the case.
Part one — relief. You dump whatever is eating you, and a tired bureaucrat at the "Ministry of Existential Safety" issues a satirical "Act No. 404" that shreds the fear through the scale of the universe and black humor. This part is generative — a language model writes it. Improvisation is exactly what makes it land, and a wrong word here costs nothing but a weaker joke.
And the relief here is real, not just a warm-up for the breakdown — it starts working two ways before any analysis. First, writing the anxiety out — getting it from your head into words — already begins to discharge it. Second, grinding the fear through absurdity and the scale of the universe makes it lighter on its own: humor devalues the fear. That's also exactly why the model is safe in this part — the relief comes from the act of writing and the absurd frame, not from the precision of any single phrase.
Part two — the breakdown. Here the bot walks you through real emotion regulation: name the feeling, check whether it fits the facts, then do the bodily "opposite action" step by step. This part has no model in it. Every word is hand-built from a clinical source, because here a wrong word costs a person the wrong instruction.
That split is the architecture. The model is allowed where a mistake is harmless and locked out where it could do harm. Everything else serves that one line.
Where does the model run, and where is it locked out?
I let the model run in exactly one place and shut it out of everywhere else. The therapeutic content, the crisis handling, and the grounding are deterministic modules with no model call. The model is a single contained function behind one part of the product.
app/
api/
bot the webhook: routing, both parts, crisis check, rate limit, admin
cron background nudges for quiet users (quiet hours, every 3-6 days)
admin statistics panel + broadcast
lib/
prompts the model's system prompt — the ONLY place AI lives
utils the DeepSeek call: 58s timeout, manual abort, in-character fallback
emotion_reg Part 2, the breakdown: a static DBT engine, 9 emotions (NO AI)
grounding grounding exercise, fixed steps (NO AI)
crisis stop-word interception, runs before everything (NO AI)
supabase data: users, message logsConversation state is a finite-state machine stored per user, not kept "in the model's head": the breakdown advances step by step in the database, idempotently, so a refresh or a double tap can't derail it.
An LLM wrapper, or an architecture with a boundary?
A wrapper sends everything to the model and hopes the output is safe. An architecture with a boundary decides what the model is allowed to produce and what it isn't. Here's the difference, line by line.
| LLM wrapper | Boundary architecture (this build) | |
|---|---|---|
| Where the model runs | everywhere, every input | only the safe zone (the relief joke) |
| Therapeutic content | generated by the model | hardcoded from a clinical source |
| A crisis message | also goes to the model | deterministic handoff → a human |
| Hallucination risk | carried by the user | cut out by the architecture |
| If the model fails | the user is left hanging | the person still gets a clean reply |
| The builder's role | prompt engineer | architect of boundaries |
Which decisions actually made the product?
The case isn't "an anxiety bot got built." The case is in where the line was drawn.
The model runs only in the safe zone
It writes the satirical "Act" and nothing else. The entire therapeutic substance of the product sits outside it.
The therapy is hardcoded from a clinical source
The breakdown is built from the emotion-regulation tables in Christine Dunkley's work — name the emotion, check it against the facts, do the bodily "opposite action." The bot delivers a verified method, identical every time, instead of inventing advice. Body-state cues are phrased as "if you're hunched over…" so the bot never tells a person they feel something they don't.
A crisis always reaches a human
A deterministic stop-word check for self-harm language runs before any other processing, in both modes. On a match the bot stops the jokes and the exercises and points the person to a live specialist. This is the one place you never hand to a probabilistic model.
The person always gets a clean reply
The generative call has a 58-second timeout under Vercel's 60-second limit and a manual abort, and any failure returns a clear in-character message instead of a hang or a loop. Reliability lives in the code, not in the model's mood. (An earlier version did loop and time out; the fix was to take that path off the model's mercy.)
State is a machine, not memory
The breakdown walks explicit steps stored in the database, idempotent against refreshes and double taps. The model's context is deliberately small — only the last few messages — so nothing bloats and nothing drifts.
The persona is the painkiller
The bureaucratic black humor — the "Reality Shredder," "Act No. 404" — devalues a fear through scale and laughter. It lives only in part one; in the breakdown and in a crisis the tone is serious and respectful, because that's where mockery would do harm. After the relief joke, one button reads "now let's break it down for real" and moves the person from catharsis into the work.
Does it work?
Yes. It's live in production on Vercel, the webhook is healthy with zero errors and no stuck updates, both parts run, and the crisis filter and the deterministic breakdown work as designed. I don't publish "reduced anxiety by N%": there's no honest baseline for that, and I won't invent one. What I stand behind is the design — the risky parts are deterministic and verified, and the model is fenced off from anything that could harm a person.
Why is this better than a wrapper over a model?
A wrapper sends everything to the model and hopes the output is safe. I decide what the model is allowed to produce. The funny part stays loose and generative; the clinical part and the crisis path stay deterministic, readable, and constant. That boundary is the deliverable — most "AI products" don't have one, and that's exactly where they break.
Building with AI and not sure where the model belongs?
I decide where a model earns its place and where it's a liability — and I architect that line, not just write prompts. AI-native development takes a product from idea to a deployed system in days, with the boundary built in from the start.
