{"slug": "one-engine-three-embedded-assistants-how-every-answer-stays-scoped", "title": "One Engine, Three Embedded Assistants: How Every Answer Stays Scoped", "summary": "Wren AI's product team published a Nov 05, 2026 post detailing how a single Wren AI engine powers three embedded assistants — a Northmart shopper, a GP in a video consult, and a Harbor & Pine claims agent — while enforcing data boundaries per session. The host application issues a signed, time-limited session token carrying identity and context keys such as agent_role, policy_id, claim_id, patient_id, clinician_id and practice_ods, and Wren Engine applies row- and column-level policies from the MDL context layer before SQL runs rather than filtering results afterward. The team argues prompt-level instructions are insufficient for patient records or claims files because \"models follow instructions most of the time.", "body_md": "[The Wren Journal](https://getwren.ai/blog)\n\nProduct, Insight\n\n# One Engine, Three Embedded Assistants: How Every Answer Stays Scoped\n\nA shopper, a GP, and a claims agent ask three very different questions inside three different products. All three answers come from one Wren AI engine, and none of them can reach data that belongs to someone else. Here is what happens inside each session.\n\nWren AI Product Team\n\nUpdated: Nov 05, 2026\n\nPublished: Nov 05, 2026\n\nThree people, three products, three questions:\n\n- Alex, a shopper on the Northmart storefront, types *\"I was charged twice for my last order.\"*\n- Dr Okafor, a GP in the middle of a video consult, asks whether metformin is safe for the patient on screen.\n- Priya, a claims agent with a policyholder on hold, needs a roadside-assistance quote and wants to know whether similar claims get flagged.\n\nEach of them gets a specific, sourced answer in seconds, inside the product they were already using. Behind all three is a single Wren AI engine. And none of them can see a single row that belongs to someone else.\n\nWe recorded a two-minute walkthrough of all three. This post explains what is going on inside each session, because the interesting part isn't that an AI can answer the question. It's what the answer is *not allowed* to include.\n\n## The hard part of embedding is the boundary\n\nPutting a chat box in your product is a weekend project. Putting one in front of real customers, on real data, is not, because a natural-language interface has no built-in edges. A dashboard only shows what someone laid out. A question box accepts anything: *\"show me all orders over $500\"*, *\"which patients are on warfarin\"*, *\"list every claim from this zip code.\"*\n\nIf the only thing between that question and your database is a prompt that says \"only answer about the current user\", you don't have a control, you have a request. Models follow instructions most of the time. Most of the time isn't good enough for a patient record or a claims file.\n\nSo in Wren AI the boundary isn't in the prompt. It travels with the session, and the engine enforces it on every query.\n\n## Step 1: the host signs who is asking\n\nEvery embedded session starts with the host application, not with Wren. The host already knows who is signed in and what they are looking at, so it puts that into a signed session token.\n\nHere is the token the Harbor & Pine agent desktop issues when Priya picks up a verified call:\n\nThree things are worth noticing:\n\n- **Identity is the host's, not the user's.** The token is signed by the Harbor & Pine backend. The caller can't type a different policy number and widen the scope, because the scope never came from the chat.\n- **Session properties carry the context.**`agent_role` ,`policy_id` , and`claim_id` are what \"this policy\" and \"my claim\" resolve to.\n- **The token has a lifetime.** It is issued when the caller is verified and revoked when the call ends. The next call gets a new token with a new scope.\n\nThe clinical workspace does the same with different keys: `patient_id`, `clinician_id`, and `practice_ods`. The thread can only query the record that is open in the EHR.\n\n## Step 2: the engine scopes the query, not the answer\n\nWhen a question comes in, Wren AI's agent plans the query through the context layer: the same metric definitions, relationships, and access policies your team modeled once in MDL. Then Wren Engine applies the row- and column-level policies bound to those session properties *before* the SQL runs.\n\nThat ordering matters. We don't generate SQL across the whole database and filter the result afterward. The query that executes can only reach rows inside the session's scope, whatever the model wrote. We covered the mechanics in [How Wren AI enforces role-based access control](https://getwren.ai/post/how-wren-ai-enforces-role-based-access-control). Embedding is the same mechanism with the identity supplied by your product instead of by a Wren login.\n\n## Step 3: the answer shows its work\n\nScoping makes an answer safe. Sources make it usable. In all three products the reply comes with the rows and SQL behind it, because the person reading it has to act on it.\n\n**Retail.** Alex's question becomes a lookup over Alex's payments only. Wren finds two $86.47 charges on order #112-7730155. One is settled. The other is an authorization that is still pending and normally drops off in three to five business days.\n\nThat answer settles most \"charged twice\" tickets before they're filed. When it doesn't, Alex clicks **Create ticket** and Wren hands the case to support with the whole conversation attached. The billing team starts from what was already found, not from \"can you describe the issue?\"\n\n**Healthcare.** Dr Okafor asks about metformin. Before answering, Wren checks the patient's record for two things a GP would want to know: the last eGFR is eight months old and down from 52 to 41, and the patient is on ibuprofen alongside ramipril and furosemide, a combination that raises kidney-injury risk. The suggestion: recheck renal function first.\n\nEach flag links to the lab result or prescription it came from, and the SQL is one click away. It's decision support the clinician can verify, not a verdict to trust blindly.\n\n## Step 4: some answers are totals only\n\nThe insurance demo shows the subtlest part of the boundary. Priya asks for a roadside-assistance quote and gets one priced from the policy's own rating rules: $2.40 a month, prorated to $8.86 for the 112 days left on the term.\n\nThen she asks whether similar claims get flagged for review. That question has to look beyond this policy, so the policy allows an aggregate and nothing more:\n\n37 of 1,284 similar collision claims in the region were referred for review, mostly for late reporting. Individual claim records stay out of reach for Priya's role, and the note is marked agent-only, so it never reaches the caller. Priya gets the benchmark she needs, and no other policyholder's file is exposed.\n\n## Why one engine instead of three\n\nYou could build each of these assistants separately. Most teams who try it end up rebuilding the same four things for every surface: identity plumbing, access policy, metric definitions, and an audit trail. Then they keep the copies in sync.\n\nWith Wren AI those live once, in the context layer. What changes from one product to the next is configuration:\n\n- **The surface.** Embedded Threads drops the full conversational UI into your app with one snippet and white-label branding. The Embedded AI API gives you governed SQL and charts so you build your own UX. Over MCP, Claude, ChatGPT, or your own agent can call Wren directly.\n- **The session properties.** A shopper ID, a patient ID, or a policy and claim, whatever your product already knows.\n- **The voice.** Your brand and your terminology, so \"refund window\" or \"deductible\" means exactly what it means in your product.\n\nThe governance doesn't change. A new surface inherits the same boundary on day one.\n\n## Try it on your own product\n\nThe three products in the video are live, with sample data, at [getwren.ai/embedded](https://getwren.ai/embedded). Open one, ask the suggested questions, then try to talk your way out of scope. You can also watch the shorter cuts on the [demos page](https://getwren.ai/demos?demo=embedded-ai-assistants-three-industries).\n\nWhen you're ready to see it on your own data, [request a demo](https://getwren.ai/request-demo) and we'll walk through which session properties your product should pass and which surface fits. If you are weighing building it in-house, the [Embedded GenBI build-vs-buy ROI worksheet](https://getwren.ai/download/embedded-roi) breaks down the cost.\n\n*The demos use sample products and sample data, for illustration only. Answers are read-only. Wren AI does not diagnose, prescribe, or make offers of coverage.*\n\n### See governed GenBI in action\n\nWatch short demos of Wren AI turning business questions into governed SQL, charts, and reusable GenBI apps.\n\n[Watch product demos](https://getwren.ai/demos)\n\n## Related posts\n\n[Oct 06, 2026](https://getwren.ai/post/embedded-analytics-where-the-work-happens)\n\n### Analytics Belongs Where the Work Happens: Four Embedded Demos You Can Try\n\nNobody leaves your product to go ask a dashboard a question. The question shows up mid-task, about the thing on screen. We built four working demos, in capital markets, retail, healthcare, and insurance, to show what happens when the answer lives there too.\n\n[Sep 28, 2026](https://getwren.ai/post/how-wren-ai-enforces-role-based-access-control)\n\n### How Wren AI Enforces Role-Based Access Control on AI-Generated SQL\n\nWren AI doesn't replace your data security policy, it enforces it. Row-level and column-level security are applied in Wren Engine at query time, driven by who is asking, even when the SQL was written by an AI.\n\n[Apr 02, 2026](https://getwren.ai/post/the-missing-context-layer-for-ai-agents-over-business-data)\n\n### The Missing Context Layer for AI Agents Over Business Data\n\nWhy we rebuilt Wren Engine from a context layer into an open context engine, and what we learned along the way\n\nThe Wren Journal\n\n## Get the next deep dive in your inbox\n\nPractical GenBI guides, product updates, and customer lessons from the Wren AI team. A couple of emails a month, no noise.\n\n### Keep reading\n\nProduct, Insight\n\n### [Analytics Belongs Where the Work Happens: Four Embedded Demos You Can Try](https://getwren.ai/post/embedded-analytics-where-the-work-happens)\n\nNobody leaves your product to go ask a dashboard a question. The question shows up mid-task, about the thing on screen. We built four working demos, in capital markets, retail, healthcare, and insurance, to show what happens when the answer lives there too.\n\nProduct, Tutorial\n\n### [How Wren AI Enforces Role-Based Access Control on AI-Generated SQL](https://getwren.ai/post/how-wren-ai-enforces-role-based-access-control)\n\nWren AI doesn't replace your data security policy, it enforces it. Row-level and column-level security are applied in Wren Engine at query time, driven by who is asking, even when the SQL was written by an AI.\n\nInsight, Product\n\n### [The Missing Context Layer for AI Agents Over Business Data](https://getwren.ai/post/the-missing-context-layer-for-ai-agents-over-business-data)\n\nWhy we rebuilt Wren Engine from a context layer into an open context engine, and what we learned along the way", "url": "https://wpnews.pro/news/one-engine-three-embedded-assistants-how-every-answer-stays-scoped", "canonical_source": "https://getwren.ai/post/one-engine-three-embedded-assistants", "published_at": "2026-11-05 00:00:00+00:00", "updated_at": "2026-11-05 18:56:50.465338+00:00", "lang": "en", "topics": ["artificial-intelligence", "ai-agents", "ai-products", "ai-tools"], "entities": ["Wren AI", "Northmart", "Harbor & Pine", "MDL", "Wren Engine"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/one-engine-three-embedded-assistants-how-every-answer-stays-scoped", "markdown": "https://wpnews.pro/news/one-engine-three-embedded-assistants-how-every-answer-stays-scoped.md", "text": "https://wpnews.pro/news/one-engine-three-embedded-assistants-how-every-answer-stays-scoped.txt", "jsonld": "https://wpnews.pro/news/one-engine-three-embedded-assistants-how-every-answer-stays-scoped.jsonld"}}