Build Multi-User Web Platform with Anthropic AI Agents

We are turning an internal, single-user AI workflow built in Claude Cowork + Supabase into a secure, multi-user web platform for a B2B trading business. The "intelligence" already exists as a working set of Anthropic Agent Skills, system prompts, and codified business rules. We need an expert team to transition it and build the full platform around it — frontend, backend, and the secure integration with our AI agents. We are not asking you to reinvent the AI logic. We will hand you our skills, prompts, and rules as the spec. Your job is to wrap them in a real product that colleagues can log into and use. We will keep working and fine tuning the agent skills and prompts on our end via Claude. This is an architecture-and-security job as much as a build job. We want someone who has shipped production agentic systems with real multi-user access control and already experienced this transition. What the platform needs to do Colleagues log into a web app and can: Upload a wish list / target list and get an AI-generated offer back. Browse the product catalog and target prices by product. Ask questions and run analyses conversationally ("what can we offer this buyer", "find me products under target price X"), powered by the same AI agents. All of the above with strict, role-based permissions — users only see and do what their role allows. An admin (us) separately maintains the agents — tuning rules, editing prompts, adding skills — outside the web app - via Claude. We will also keep expanding the database in Supabase via Claude. Normal web users must never be able to edit prompts, skills, or business rules. In scope (what you build) 1. Frontend web app Built on Lovable, or a similar rapid app-builder / modern web stack (open to your recommendation — tell us what you'd use and why). Login, role-based UI, wish-list upload, catalog and target-price browsing, and a conversational/chat surface for AI queries. Clean, responsive, business-grade UX. 2. Backend & AI agent integration Server-side integration with Anthropic AI agents (architecture open — propose your approach: hosted agent runtime vs. self-managed agent loop, etc.). Secure handling of API keys and credentials — these must live server-side only, never in the browser. Async job handling for longer agent runs (submit → run → generate output file, e.g. Excel offer → store → notify the user), plus a good streaming/real-time experience in the chat. Supabase is the DB layer. 3. Role-based access control (security-critical) Per-user authorization on every data access and action; the AI agent must never hold broad/admin-level credentials in the multi-user product. Each agent session scoped to the authenticated user's identity and role. Defense-in-depth at the data layer (e.g. row-level security or equivalent), not just in the UI. 4. Admin authoring & deploy workflow Our agents' skills, prompts, and rules stay in a version-controlled source of truth that we maintain. A clean way to publish updates to the live agents, with staging → production promotion and rollback. Web users have no path to edit any of this. Phase 2 (separate milestone — quote separately) 5. Email AI coworker — an inbound address that maps sender → known user/role, runs the same agents/skills on the email + attachments, and returns a draft offer for human approval before sending. 6. WhatsApp AI coworker — a WhatsApp adapter using the same agents; chat thread maps to a persistent session, same identity/authorization rules as the web app. Out of scope (we handle these) Designing the matching/pricing logic (we provide it as skills + rules). Product/business decisions about agent behavior. Frontend design Hard requirements (non-negotiable) API keys and admin credentials never reach the browser. No admin-scoped data access exposed to the agent in the multi-user product — all access is authorization-mediated. Every agent session is scoped to the authenticated user's role. Outbound communications (offers via email/WhatsApp, Phase 2) go through a human-approval step. Architecture choices documented and justified, with a clean separation between frontend, backend/gateway, and agents. Tech you should know Anthropic Claude API / agents / Agent Skills, building and securing multi-tenant web apps, role-based access control and row-level security, async jobs and real-time/streaming UX, rapid app builders (Lovable or similar) and/or modern web stacks. Phase 2: WhatsApp Business / Twilio, inbound email parsing. Deliverables A working, role-based multi-user web app (frontend + backend). Secure AI-agent integration with scoped, per-user access. Admin publish/deploy workflow for agent skills and prompts (staging/prod, rollback). Tests for the authorization layer and a basic eval harness for the AI matching. Handover docs + a short walkthrough.