How I built the Fusion Cloud AI-Readiness Assessment demo

Nothing but enums reaches the prompt

Every input — agent use case, transaction volume, integration method, governance controls — is validated against a fixed allowlist before anything is assembled into a prompt:

const USE_CASES = [
  "AP invoice exceptions (Fusion Payables)",
  "Procurement requisition triage (Fusion Procurement)",
  "GL journal review & anomaly detection (Fusion General Ledger)",
  "Expense report auditing (Fusion Expenses)",
] as const;
const VOLUMES = ["<1,000/month", "1,000–10,000/month",
                  "10,000–100,000/month", "100,000+/month"] as const;
const INTEGRATION_METHODS = ["No integration yet — planning phase",
  "Calling Fusion REST APIs directly",
  "Oracle Integration Cloud (OIC) as middleware",
  "Oracle AI Agent Studio (business-object + deep-link tools)"] as const;

There's no free-text field anywhere in this form. A public demo endpoint that accepts arbitrary text and feeds it to a system prompt is a prompt-injection surface; a form that only accepts membership in a known set removes that surface entirely rather than trying to sanitize around it.

The prompt reasons about the specific selection

The system prompt frames Claude as a senior AI-governance architect and explicitly instructs it to reference real Fusion Cloud ERP concepts for the use case actually selected — Payables invoice holds and matching for AP exceptions, supplier and purchase-order approval for procurement triage, chart-of-accounts and period-close controls for GL review — rather than returning generic AI-governance advice that would apply to any input. Each governance control is marked Present, Absent, or Unknown (the default), and the prompt keeps those apart. One conditional line does real work: if fewer than two controls are confirmed present and at least one is confirmed absent, the prompt requires the response to call that out as a structural blocker to autonomous agent action, not a minor gap to note in passing. Unknown controls are never described as missing and never trigger that verdict on their own; they come back as items to confirm, with a provisional score.

The response is validated, not trusted

Structured output from a model is still a string until proven otherwise. Before anything reaches the client:

• ✓Code fences are stripped and the outermost JSON object is extracted defensively — models sometimes wrap output in commentary even under instruction not to.
• ✓readinessScore is clamped into the 1–10 range with Math.min/Math.max, and rejected outright if it isn't a finite number.
• ✓recommendedApproach.approach is lowercased and checked against exactly three allowed values (pilot-ready / needs-guardrails / not-ready) — anything else fails the request rather than silently passing through.
• ✓keyGaps and nextSteps are truncated to 3 items regardless of how many the model returns, keeping the response shape predictable for the UI.