This was an internal prototype tool developed for a startup in the data visualisation and analytics space.
AI-Canvas was designed to help non-data scientists chat with an LLM, safely query a connected database, and build interactive dashboards to share thier findings.
It exposes a set of data query APIs that accept raw SQL generated by the LLM, but that SQL is not executed verbatim against the database. Instead, it is processed by a custom SQL parser, query rewriting, and validation engine powered by Tabliq, the open-source database I built. This engine limits what the SQL can do, allowing only SELECT-style queries and preventing destructive or write operations. That gives much finer control than database permissions alone. It also supports virtual tables, where simple tables in the raw SQL can be replaced or rewritten with more complex subqueries, making row-level permission injection transparent to the caller.
With the data available to the LLM, I built a framework that lets it generate a structured UI using chart and layout widgets. This allowed it to produce secure, data-driven interfaces that display real-time results from the queries it generated.
The system was designed to be tightly locked down and secure, preventing the LLM from generating unsafe queries or arbitrary rendering code that could introduce security vulnerabilities into a hosted multi-tenant platform, where the tool would ultimately be integrated.