Claude's Corner: o11 - The AI Agent That Lives Inside Your Enterprise Apps

# How to Build o11 with Claude Code

A step-by-step guide to building an AI agent platform that executes natively inside Microsoft Office, Google Workspace, and financial CRMs.

---

## Step 1: Monorepo Setup (Next.js API + Office Manifest + Apps Script)

Set up a monorepo with three workspaces: the Next.js backend API, the Office add-in frontend (React task pane), and the Google Apps Script workspace add-on.

```
/packages
  /api          # Next.js 14 App Router - API routes + auth
  /office-addin # React app bundled as Office task pane
  /apps-script  # Google Apps Script + clasp config
/manifests
  office-manifest.xml   # Office add-in manifest
  workspace-addon.json  # Google Workspace add-on config
```

Initialize with pnpm workspaces. Use `@microsoft/office-addin-dev-certs` for local HTTPS (Office requires it). Set up `clasp` (Google Apps Script CLI) pointing at a Google Cloud project with the Workspace Add-ons API enabled.

Key manifest config for Office: set `DefaultValue` in `AppDomains` to your ngrok/tunnel URL for dev, your production domain for prod. Request only the permission scopes you need - Office add-ins go through admin consent, and requesting overly broad scopes will block enterprise deployment.

```bash
pnpm create next-app packages/api --typescript --app
npx office-addin-dev-certs install
npm install -g @google/clasp && clasp login
```

---

## Step 2: Database Schema (Tenants, Users, Workflows, Templates, Audit Logs)

Design for multi-tenancy from day one. Financial services firms will require data isolation.

```sql
-- Tenant isolation
CREATE TABLE tenants (
  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
  name TEXT NOT NULL,
  domain TEXT UNIQUE NOT NULL,        -- e.g. blackstone.com
  ms_tenant_id TEXT,                  -- Azure AD tenant ID
  google_customer_id TEXT,            -- Google Workspace customer ID
  plan TEXT DEFAULT 'enterprise',
  created_at TIMESTAMPTZ DEFAULT NOW()
);

-- Users scoped to tenants
CREATE TABLE users (
  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
  tenant_id UUID REFERENCES tenants(id) ON DELETE CASCADE,
  email TEXT NOT NULL,
  display_name TEXT,
  ms_oid TEXT,                        -- Azure AD object ID
  google_sub TEXT,                    -- Google OIDC subject
  role TEXT DEFAULT 'member',         -- member | admin
  created_at TIMESTAMPTZ DEFAULT NOW(),
  UNIQUE(tenant_id, email)
);

-- Workflow execution records
CREATE TABLE workflows (
  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
  tenant_id UUID REFERENCES tenants(id) ON DELETE CASCADE,
  user_id UUID REFERENCES users(id),
  workflow_type TEXT NOT NULL,        -- lbo_model | pitch_deck | diligence_doc
  platform TEXT NOT NULL,             -- excel | word | powerpoint | sheets | docs | slides
  status TEXT DEFAULT 'pending',      -- pending | running | complete | failed
  input_prompt TEXT,
  source_documents JSONB DEFAULT '[]',
  output_summary JSONB,
  tokens_used INTEGER,
  started_at TIMESTAMPTZ,
  completed_at TIMESTAMPTZ,
  created_at TIMESTAMPTZ DEFAULT NOW()
);

-- Reusable prompt/template library
CREATE TABLE templates (
  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
  tenant_id UUID REFERENCES tenants(id) ON DELETE CASCADE,
  name TEXT NOT NULL,
  workflow_type TEXT NOT NULL,
  prompt_template TEXT NOT NULL,
  schema_version INTEGER DEFAULT 1,
  is_shared BOOLEAN DEFAULT FALSE,
  created_by UUID REFERENCES users(id),
  created_at TIMESTAMPTZ DEFAULT NOW()
);

-- Compliance audit log
CREATE TABLE audit_logs (
  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
  tenant_id UUID REFERENCES tenants(id) ON DELETE CASCADE,
  user_id UUID REFERENCES users(id),
  action TEXT NOT NULL,               -- workflow_started | doc_accessed | template_created
  resource_type TEXT,
  resource_id UUID,
  metadata JSONB DEFAULT '{}',
  ip_address INET,
  user_agent TEXT,
  created_at TIMESTAMPTZ DEFAULT NOW()
);

CREATE INDEX idx_audit_logs_tenant_created ON audit_logs(tenant_id, created_at DESC);
CREATE INDEX idx_workflows_tenant_status ON workflows(tenant_id, status);
```

---

## Step 3: Build the Office JS Task Pane Add-in (React inside Word/Excel/PowerPoint)

The task pane is a React app that loads inside the Office ribbon. It communicates with the host document via the Office JS API.

```typescript
// packages/office-addin/src/taskpane/App.tsx
import { useEffect, useState } from "react";
import * as Office from "@microsoft/office-js";

export default function App() {
  const [ready, setReady] = useState(false);
  const [platform, setPlatform] = useState<string>("");

  useEffect(() => {
    Office.onReady((info) => {
      setPlatform(info.host?.toString() ?? "unknown");
      setReady(true);
    });
  }, []);

  const runWorkflow = async (prompt: string) => {
    // Call your API
    const res = await fetch("/api/workflow/start", {
      method: "POST",
      headers: { "Content-Type": "application/json" },
      body: JSON.stringify({ prompt, platform }),
    });
    const { workflowId } = await res.json();
    pollWorkflow(workflowId);
  };

  const writeToExcel = async (data: any[][]) => {
    await Excel.run(async (ctx) => {
      const sheet = ctx.workbook.worksheets.getActiveWorksheet();
      const range = sheet.getRange("A1").getResizedRange(
        data.length - 1,
        data[0].length - 1
      );
      range.values = data;
      await ctx.sync();
    });
  };

  // ... render task pane UI
}
```

Key patterns:
- Always call `Office.onReady()` before using any Office JS APIs
- Use `Excel.run()`, `Word.run()`, `PowerPoint.run()` for their respective contexts - they handle the batch/sync pattern
- VSTO is for scenarios that need deeper COM access (reading custom XML parts, accessing the full document object model) - ship the Office JS add-in first, add VSTO for power-user workflows

---

## Step 4: Build the Google Workspace Add-on Sidebar

Google Workspace add-ons use a card-based UI built with the CardService API in Apps Script, or a web app sidebar loaded via `HtmlService`.

```javascript
// packages/apps-script/src/Sidebar.gs

function onOpen(e) {
  SlidesApp.getUi()
    .createAddonMenu()
    .addItem("Open o11", "showSidebar")
    .addToUi();
}

function showSidebar() {
  const html = HtmlService.createHtmlOutputFromFile("sidebar")
    .setTitle("o11")
    .setWidth(300);
  SlidesApp.getUi().showSidebar(html);
}

// Called from sidebar JS via google.script.run
function runWorkflow(prompt, platform) {
  const token = ScriptApp.getOAuthToken();
  const user = Session.getEffectiveUser().getEmail();

  const response = UrlFetchApp.fetch("https://your-api.com/api/workflow/start", {
    method: "post",
    contentType: "application/json",
    headers: { "Authorization": "Bearer " + token },
    payload: JSON.stringify({ prompt, platform, user }),
  });

  return JSON.parse(response.getContentText());
}

function writeToSheet(data) {
  const sheet = SpreadsheetApp.getActiveSpreadsheet().getActiveSheet();
  sheet.getRange(1, 1, data.length, data[0].length).setValues(data);
}
```

The `appsscript.json` manifest declares OAuth scopes. For Sheets write access you need `https://www.googleapis.com/auth/spreadsheets`. For Docs: `https://www.googleapis.com/auth/documents`. Request only what you use - Google reviews scope justifications for Workspace Marketplace submissions.

---

## Step 5: LLM Orchestration Layer (RAG Pipeline, Prompt Chains for Financial Docs)

The orchestration layer is the core of the product. It sits in your Next.js API and coordinates document ingestion, retrieval, and generation.

```typescript
// packages/api/src/lib/orchestrator.ts
import OpenAI from "openai";
import Anthropic from "@anthropic-ai/sdk";

const openai = new OpenAI();
const anthropic = new Anthropic();

// Document ingestion pipeline
export async function ingestDocument(
  fileBuffer: Buffer,
  mimeType: string,
  tenantId: string,
  documentId: string
) {
  // 1. Extract text (PDF: use pdf-parse or AWS Textract for tables)
  const text = await extractText(fileBuffer, mimeType);

  // 2. Chunk with overlap for financial docs (larger chunks preserve context)
  const chunks = chunkText(text, { size: 1200, overlap: 200 });

  // 3. Embed and store
  const embeddings = await openai.embeddings.create({
    model: "text-embedding-3-large",
    input: chunks.map((c) => c.text),
  });

  await storeChunks(chunks, embeddings.data, tenantId, documentId);
}

// RAG retrieval
export async function retrieveRelevant(
  query: string,
  tenantId: string,
  topK: number = 8
): Promise<string[]> {
  const queryEmbedding = await openai.embeddings.create({
    model: "text-embedding-3-large",
    input: query,
  });

  return vectorSearch(queryEmbedding.data[0].embedding, tenantId, topK);
}

// Financial workflow orchestration
export async function runFinancialWorkflow(params: {
  workflowType: "lbo_model" | "pitch_deck" | "diligence_doc";
  prompt: string;
  tenantId: string;
  documentIds: string[];
}) {
  const context = await retrieveRelevant(params.prompt, params.tenantId);

  const systemPrompt = getSystemPrompt(params.workflowType);

  // Use Claude for complex multi-step reasoning on long documents
  const response = await anthropic.messages.create({
    model: "claude-opus-4-5",
    max_tokens: 8192,
    system: systemPrompt,
    messages: [
      {
        role: "user",
        content: `Context from source documents:

${context.join("

---

")}

Request: ${params.prompt}`,
      },
    ],
  });

  return parseWorkflowOutput(response.content[0], params.workflowType);
}

function getSystemPrompt(workflowType: string): string {
  const prompts: Record<string, string> = {
    lbo_model: `You are a financial modeling expert. Output structured JSON representing a leveraged buyout model with these sections: entry_assumptions, debt_schedule, income_statement_projections, cash_flow_projections, returns_analysis. All numbers must be numeric (not strings). Use standard PE firm conventions.`,
    pitch_deck: `You are an investment banking analyst. Output a JSON array of slide objects, each with: slide_number, title, body_bullets (array of strings), speaker_notes. Follow CIM and pitch book conventions standard at bulge bracket banks.`,
    diligence_doc: `You are a private equity due diligence analyst. Output structured JSON diligence findings with sections: executive_summary, key_risks (array), key_opportunities (array), financial_analysis, management_assessment, recommendation.`,
  };
  return prompts[workflowType] ?? prompts.diligence_doc;
}
```

For vector storage, use pgvector (available on Supabase) with per-tenant row-level security so embeddings from one firm cannot leak to another.

---

## Step 6: Enterprise Auth and Compliance (Azure AD OAuth, Google Workspace OIDC, SOC 2 Logging)

Enterprise auth is not optional. Banks will not deploy without it.

```typescript
// packages/api/src/lib/auth/azure.ts
import { ConfidentialClientApplication } from "@azure/msal-node";

const msalClient = new ConfidentialClientApplication({
  auth: {
    clientId: process.env.AZURE_CLIENT_ID!,
    clientSecret: process.env.AZURE_CLIENT_SECRET!,
    authority: "https://login.microsoftonline.com/common",  // multi-tenant
  },
});

export async function validateAzureToken(token: string) {
  // Verify JWT signature against Microsoft JWKS
  // Extract tenant ID (tid claim) and user OID
  // Look up or create tenant + user record
  const decoded = await verifyMicrosoftJwt(token);
  return {
    tenantId: await getOrCreateTenant(decoded.tid, "microsoft"),
    userId: await getOrCreateUser(decoded.oid, decoded.upn, decoded.tid),
  };
}

// packages/api/src/lib/auth/google.ts
import { OAuth2Client } from "google-auth-library";

const googleClient = new OAuth2Client(process.env.GOOGLE_CLIENT_ID);

export async function validateGoogleToken(idToken: string) {
  const ticket = await googleClient.verifyIdToken({
    idToken,
    audience: process.env.GOOGLE_CLIENT_ID,
  });
  const payload = ticket.getPayload()!;
  return {
    tenantId: await getOrCreateTenant(payload.hd ?? payload.sub, "google"),
    userId: await getOrCreateUser(payload.sub, payload.email!, payload.hd),
  };
}

// SOC 2 compliant audit logging - call this on every significant action
export async function auditLog(params: {
  tenantId: string;
  userId: string;
  action: string;
  resourceType?: string;
  resourceId?: string;
  metadata?: Record<string, any>;
  req: Request;
}) {
  await db.query(
    `INSERT INTO audit_logs (tenant_id, user_id, action, resource_type, resource_id, metadata, ip_address, user_agent)
     VALUES ($1, $2, $3, $4, $5, $6, $7, $8)`,
    [
      params.tenantId,
      params.userId,
      params.action,
      params.resourceType,
      params.resourceId,
      JSON.stringify(params.metadata ?? {}),
      getClientIp(params.req),
      params.req.headers.get("user-agent"),
    ]
  );
}
```

For SOC 2 Type II readiness: retain audit logs for 12 months minimum, encrypt at rest (Supabase does this by default), implement log immutability (no UPDATE/DELETE on audit_logs), and document your data retention and access control policies.

---

## Step 7: Deploy and Distribute (Microsoft AppSource, Google Workspace Marketplace, Multi-tenant)

Deployment has two tracks: cloud infrastructure and marketplace listing.

**Cloud infrastructure:**

```yaml
# docker-compose.yml (or Fly.io / Railway config)
services:
  api:
    image: your-registry/o11-api:latest
    environment:
      - DATABASE_URL=${DATABASE_URL}
      - AZURE_CLIENT_ID=${AZURE_CLIENT_ID}
      - AZURE_CLIENT_SECRET=${AZURE_CLIENT_SECRET}
      - GOOGLE_CLIENT_ID=${GOOGLE_CLIENT_ID}
      - OPENAI_API_KEY=${OPENAI_API_KEY}
      - ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY}
    ports:
      - "3000:3000"
```

Deploy to a region where your financial services customers are (us-east-1 for US banks). Enable WAF. Use secrets manager, not .env files, in production.

**Microsoft AppSource submission:**

1. Create a Partner Center account at partner.microsoft.com
2. Validate your Office manifest with `npx office-addin-manifest validate`
3. Bundle your React task pane app as a static site (no SSR inside the task pane iframe)
4. Submit to AppSource - review takes 2-4 weeks. Common rejection reasons: missing privacy policy URL, HTTPS required for all endpoints, permission scope justification required
5. For enterprise direct deployment (faster for initial customers): admins can sideload the manifest via Microsoft 365 admin center without AppSource review

**Google Workspace Marketplace submission:**

1. Configure OAuth consent screen in Google Cloud Console - choose "Internal" for testing, "External" for public listing
2. Create the Workspace Add-on listing in Google Cloud Marketplace
3. Scope justification: write a detailed explanation for each OAuth scope requested - Google reviewers read these
4. Review takes 1-3 weeks. Rejection reasons: scope creep, missing Terms of Service, add-on does not function as described

**Multi-tenant deployment checklist:**
- Row-level security on all tenant-scoped tables
- Separate pgvector collections per tenant (or tenant_id column with RLS)
- Rate limiting per tenant (not per IP) to prevent noisy neighbor problems
- Tenant offboarding: data deletion pipeline for GDPR/CCPA compliance
- Webhook endpoints for Microsoft and Google lifecycle events (install, uninstall, plan change)