Production HR Synthetic Workers on AWS with OpenClaw
FCamara's intelligent People/HR agent platform: cloud architecture, integration with Microsoft Teams and WhatsApp Cloud API, anti-hallucination governance anchored in SharePoint, and zero exposed management ports.
With hundreds of employees and dynamic internal policies (vacations, benefits, medical leaves, expense reports), FCamara's People team was overloaded by repetitive queries spread across disparate channels.
Conventional support bots frequently stumble in this environment: they either rely on naive vector RAG that chops tables and hallucinates benefit policies, or lack strict privilege separation for sensitive employee and payroll records. The goal was to build a production synthetic workforce combining rigorous security, agentic retrieval, and native presence across channels employees already use every day.
Synthia handles general company-wide People queries on Teams and WhatsApp. The BP (Business Partner) agent manages sensitive employee data via Orange integration, structurally restricted to Microsoft Teams behind Entra ID authentication.
No policy is inferred or remembered without grounding: SharePoint acts as the single source of truth for knowledge, synced in real time.
Native experience on the corporate desktop (Teams) and in employees' pockets (official Meta WhatsApp with native voice notes and files).
An end-to-end engineering view: from channel ingress and TLS termination to containerized runtime on AWS, LLM integration, and voice synthesis.
The infrastructure was engineered to operate cost-effectively, reliably, and modularly on a single EC2 Graviton t4g.small instance with Docker Compose. Caddy serves as the secure edge terminating TLS :443 and routing only strictly authorized endpoints, isolating the OpenClaw gateway and supporting microservices.
Inspect the diagram nodes and toggle flows to trace each request path:
Colaboradores FCamara
Meta Webhook Oficial
Fonte Única da KB
56.126.101.37.sslip.io
Plugins: whatsapp-cloud + ler_documento
MarkItDown ➔ INDEX.md + .kb-map.json
SSE stream:true ⇄ JSON batch
Cérebro & Visão
Voz de Marca
Terraform + SSM
Arquitetura ponta a ponta: 3 canais de entrada, terminação TLS na borda com Caddy, 4 microserviços Docker em EC2 ARM64 e integração com Symphony LLM e ElevenLabs.
Pragmatic engineering solutions designed to overcome enterprise protocol constraints, streaming quirks, and document ingestion challenges.
Instead of chopping documents into opaque vector chunks that lose benefit table context, the pipeline converts SharePoint documents (PDF, Word, PowerPoint) into clean Markdown and generates a semantic INDEX.md. Synthia browses the index and performs active lookups on demand through the dedicated ler_documento tool, ensuring complete context and accurate citations.
The OpenClaw gateway was built to require stream: true with Server-Sent Events (SSE). However, the enterprise Symphony LLM API only responds in batch JSON (stream: false). We built a lightweight Python shim microservice that translates batch JSON into SSE chunks with sanitized finish_reasons in real time.
We eliminated legacy HTTP bridge proxies in favor of a proprietary plugin running directly inside the runtime. For voice responses, the channel instructs ElevenLabs to synthesize directly in opus_48000_64 (Ogg/Opus), delivering native voice notes on WhatsApp without bundling FFmpeg in the container.
Fully automated Terraform deployment in the sa-east-1 (São Paulo) region, ensuring employee PII and knowledge bases remain in Brazil.
No management ports exposed to the public internet. Administrative access, deployments, and monitoring are orchestrated exclusively via AWS Systems Manager (SSM Session Manager and SSM Run Command).
Secrets and API tokens reside in AWS SSM Parameter Store (SecureString) and are loaded dynamically into memory during deployment, never committed to git.
Persistent state (~/.openclaw containing SQLite, sessions, and workspaces) sits on a dedicated EBS volume decoupled from the EC2 root, safeguarded by prevent_destroy and daily automated DLM snapshots.
Automated TLS provisioning and renewal, exposing only authorized endpoints (/api/messages, /whatsapp, and /kb with x-kb-token) while returning strict 404s for any unmapped route.
Demonstrated operational efficiency with near-instant response times and high employee satisfaction.
Watch Synforce in action, resolving complex HR queries with natural dialogue and corporate grounding: